Threats affecting pkg:npm/OpenClaw

OpenClaw versions up to 2026.4.1 have a vulnerability where Slack thread context fetched via the API was not properly filtered by the sender allowlist. This allowed messages from non-allowlisted senders to be included in the agent context if an allowlisted user replied in the same thread. The issue is fixed in version 2026.4.2.

OpenClaw versions prior to 2026.4.20 contain a vulnerability in the assistant-media route where trusted-proxy callers were authenticated but the enforcement of operator scopes on identity-bearing HTTP auth paths was missing. This allowed trusted-proxy callers without the required operator.read scope to access assistant-media files and metadata within allowed media roots. The route still required gateway authentication and media-root checks. The issue is fixed in version 2026.4.20.

OpenClaw versions from 2026.4.7 up to but not including 2026.4.15 contain a vulnerability in the webchat media embedding feature. This flaw allows crafted tool-result media references to bypass local-root containment policies, potentially causing the host to read local files or access Windows UNC/network paths. This could lead to disclosure of host files or exposure of network credentials on Windows systems. The issue is fixed in version 2026.4.15, which enforces strict local-root containment and rejects remote-host file URLs and Windows network paths before any filesystem access.

OpenClaw versions 2026.4.9 up to but not including 2026.4.10 contain a vulnerability where sender and group-scoped read policies are bypassed in host media attachment reads. This allows a sender denied read access by policy to still trigger local file reads via outbound media, potentially disclosing host-local files accessible by the OpenClaw process. The issue arises from a mismatch in policy enforcement between sender/group restrictions and the host-media read helper. The vulnerability is fixed in version 2026.4.10.

A vulnerability in the openclaw npm package (versions before 2026.4.10) allows QQBot media tags in AI reply text to read arbitrary local files outside the intended media storage boundary. This local file disclosure issue was fixed in version 2026.4.10 and later.

A vulnerability in the OpenClaw npm package versions 2026.2.23 up to but not including 2026.4.12 weakens the exec approval binding for opaque multi-call binaries such as busybox and toybox. This flaw allows these binaries to obscure which applet or script-like behavior is executed, potentially leading to incorrect risk classification. The issue was fixed in version 2026.4.12 and later.

A vulnerability in the openclaw package prior to version 2026.4.10 allowed operator.write message tools to access and persist Matrix profile configuration without requiring admin-level authority. This issue could enable unauthorized modification of persistent profile configurations. The vulnerability has been fixed in version 2026.4.10 and later.

OpenClaw versions from 2026.4.5 up to but not including 2026.4.10 contain a vulnerability allowing sandboxed agents to bypass sandbox execution routing by overriding the host parameter to 'node'. This flaw enables execution routing to a remote node instead of the intended sandbox, violating sandbox boundaries. The issue is fixed in version 2026.4.10 and later.

OpenClaw versions prior to 2026.4.9 have a vulnerability where workspace provider authentication choices could automatically enable untrusted provider plugins during non-interactive onboarding. This occurs because the system might select an auth choice shadowed by an untrusted workspace plugin, leading to unintended plugin activation. The issue is fixed in version 2026.4.9 and later.

OpenClaw versions prior to 2026.4.10 contain a vulnerability where existing-session browser interaction routes bypass server-side request forgery (SSRF) policy enforcement. This allows these routes to interact with or navigate targets without the SSRF navigation guard applied to other guarded browser routes. The issue was fixed in version 2026.4.10 and later.

A vulnerability in the openclaw npm package versions prior to 2026.4.10 allows the browser tabs action select and close routes to bypass the configured SSRF policy. This weakness undermines tab-level navigation protections by permitting operations on targets without enforcing SSRF restrictions. The issue has been fixed in version 2026.4.10 and later.

OpenClaw versions prior to 2026.4.10 have a vulnerability where channel setup catalog lookups may include untrusted workspace plugin shadows. This can cause setup-time plugin loading without the intended trust gate, potentially allowing untrusted code execution during plugin setup. The issue is fixed in version 2026.4.10 and later.

A vulnerability in the OpenClaw npm package prior to version 2026.4.10 allowed the screen_record tool's outPath parameter to bypass the workspace-only filesystem guard. This permitted an authorized tool call to write files outside the intended workspace boundary. The issue was fixed in version 2026.4.10 and later releases.

OpenClaw versions prior to 2026.4.14 had a browser SSRF policy that allowed private-network navigation by default. This behavior could expose internal services or metadata endpoints through browser-driven requests where stricter SSRF protections were expected. The issue was fixed in version 2026.4.14 by enforcing strict SSRF configuration semantics and disabling private-network access unless explicitly enabled.

A vulnerability in the openclaw npm package prior to version 2026.4.12 allows SSRF via QQBot reply media URL handling. This flaw causes the system to treat remote media URLs as trusted, enabling SSRF fetches whose returned bytes are re-uploaded through the channel. The issue is fixed in openclaw version 2026.4.12 and later.

OpenClaw versions prior to 2026.4.9 are vulnerable to a security issue where a malicious workspace .env file can inject runtime-control variables. This can alter critical runtime behaviors such as update sources, gateway URLs, ClawHub resolution, and browser executable paths. The vulnerability is addressed by blocking these runtime-control keys from being loaded from workspace .env files. A fix is available starting from version 2026.4.9.

A vulnerability in the openclaw npm package versions 2026.4.7 through 2026.4.9 allowed Discord event cover images to bypass sandbox media normalization. This flaw permitted host-local media references to reach channel action paths expecting normalized media, potentially exposing sensitive local media. The issue was fixed in version 2026.4.10.

OpenClaw versions prior to 2026.4.12 contain a vulnerability where empty approver lists could be interpreted as explicit approval authorization. This flaw allows an attacker outside the normal channel authorization to resolve pending approvals if they know an approval ID. The issue is fixed in version 2026.4.12 and later.

OpenClaw versions prior to 2026.4.10 contain a vulnerability where agent hook events could enqueue trusted system events from unsanitized external input. This flaw allows untrusted input to be processed with higher trust context within the agent. The issue was fixed in version 2026.4.10 by sanitizing hook names and marking agent hook system events as untrusted before enqueueing them.

OpenClaw versions from 2026.2.22 up to but not including 2026.4.12 contain a vulnerability where shell-wrapper detection missed environment-argv assignment injection forms. This flaw could affect execution semantics by allowing high-risk shell environment variables to be manipulated. The issue was fixed in version 2026.4.12 and later.