Threats affecting pkg:npm/OpenClaw

OpenClaw versions up to 2026.4.1 contain a low-severity timing side channel vulnerability in shared-secret comparison call sites. These call sites used early length-mismatch checks instead of a constant-time shared fixed-length comparison helper, allowing secret-length information to be leaked via timing differences. The issue does not directly lead to authentication bypass but weakens the intended constant-time secret comparison. The vulnerability is fixed in OpenClaw version 2026.4.2.

OpenClaw versions prior to 2026.4.2 have a vulnerability in the Zalo webhook replay deduplication mechanism where dedupe keys are not sufficiently scoped across chat and sender dimensions. This can cause legitimate webhook events from different conversations or senders to be incorrectly identified as duplicates and dropped. The issue leads to silent message suppression and disrupts bot workflows, impacting availability of webhook event processing. A fix is available in version 2026.4.2.

OpenClaw versions up to 2026.4.1 have a vulnerability where remote CDP discovery can return a trailing-dot localhost host (e.g., 'localhost.') that bypasses loopback-host normalization. This allows a remote CDP profile to pivot connections back to the localhost interface, weakening loopback protections and potentially exposing localhost browser state. The issue is fixed in OpenClaw 2026.4.2.

OpenClaw versions up to 2026.4.1 expose local host filesystem paths and deployment metadata to low-privilege authenticated clients via the Gateway connect success snapshot. This information disclosure allows non-admin clients to learn sensitive host configuration details that are unnecessary for their role. The issue is fixed in version 2026.4.2.

OpenClaw versions from 2026.2.26 up to but not including 2026.3.31 enforced pending pairing-request caps per channel file rather than per account. This allowed requests from other accounts on multi-account channels to fill the shared pending window, blocking new pairing challenges on unaffected accounts. The issue caused denial of service for new pairing or onboarding requests on other accounts until existing requests were resolved. It did not permit cross-account approval, data access, or authorization bypass. The vulnerability was fixed in version 2026.3.31.

OpenClaw versions prior to 2026.3.31 have a vulnerability where shell init-file options like --rcfile, --init-file, and --startup-file could bypass exec allowlist script matching. This allows an attacker to execute initialization scripts of their choosing under certain restricted conditions. The issue is limited to scenarios where exec allowlist or allow-always behavior is enabled and an attacker can control the shell-wrapper command shape. The vulnerability was fixed in OpenClaw 2026.3.31.

OpenShell's `mirror` mode in the openclaw npm package can convert untrusted sandbox files into explicitly enabled workspace hooks, which are then executed on the host during gateway startup. This vulnerability affects versions up to 2026.3.24 and is fixed starting from version 2026.3.28. Exploitation requires mirror mode enabled, hooks enabled, explicit hook opt-in, and a restart, making exploitation conditions narrow.

A vulnerability in the openclaw npm package allows users with operator.write privileges to access admin-level Telegram configuration and cron persistence via the send function. This is an authenticated escalation of privilege with a narrower scope, rated medium severity by maintainers but high by CVSS. Versions prior to 2026.3.28 are affected, with a fix released in version 2026.3.28.

OpenClaw versions prior to 2026.3.24 contain a high-severity vulnerability (CVE-2026-41384) involving environment variable injection in the CLI backend via malicious workspace configuration. This flaw allows an attacker to inject environment variables into the CLI backend runner, potentially leading to high impact on confidentiality, integrity, and availability. The issue is fixed starting from version 2026.3.24 by sanitizing the backend environment before process spawn.

OpenClaw versions up to 2026.3.28 contain a vulnerability in the Tlon media downloads feature that allows bypassing core safety limits on size, count, and cleanup. This can lead to disk exhaustion through resource exhaustion, impacting availability. The issue is fixed in version 2026.3.31.

A vulnerability in the OpenClaw npm package causes Discord component interaction to misclassify Group Direct Messages (Group DMs) as Direct Messages (DMs). This flaw affects versions prior to 2026.3.31 and can lead to incorrect policy enforcement or session handling related to Group DMs. The issue is classified as medium severity with a CVSS score of 5.4. A fix has been released in version 2026.3.31.

OpenClaw versions up to 2026.3.28 contain a low-severity access control vulnerability where the diffs viewer misclassifies proxied remote requests as local loopback requests when the 'allowRemoteViewer' setting is disabled. This flaw was fixed in version 2026.3.31.

OpenClaw versions up to 2026.3.28 have a vulnerability where Discord slash commands bypass the group DM channel allowlist. This allows authorized Discord users to bypass channel restrictions within group DMs. The issue is fixed in version 2026.3.31. The vulnerability has moderate severity with limited impact confined to users already authorized in the group DM.

OpenClaw versions prior to 2026.3.22 contain a vulnerability where bootstrap setup codes are not properly bound to the intended device roles and scopes. This flaw allows an attacker to escalate privileges during the initial pairing process. The issue has been fixed in version 2026.3.22 and later.

OpenClaw versions up to 2026.3.28 contain a vulnerability where a paired node with the role 'node' can escalate privileges to execute remote code on the gateway via unrestricted node.event agent dispatch. This requires an already trusted paired node foothold. The issue is patched in version 2026.3.31.

OpenClaw versions up to 2026.3.28 have an incomplete fix for CVE-2026-32062, where the voice-call feature still parses large WebSocket frames before validating the start of the connection. This leads to a resource consumption vulnerability. The issue is fixed in version 2026.3.31.

The OpenClaw package versions up to 2026.3.28 have a vulnerability where the gateway's device token rotation function does not terminate active WebSocket sessions after credentials are rotated. This creates a post-compromise revocation gap, allowing already-authenticated WebSocket sessions to remain active despite token rotation. The issue is classified as medium severity with a CVSS score of 5.4. A fix is available in version 2026.3.31 and later.

CVE-2026-41333 is a low-severity vulnerability in the openclaw npm package where a fake DeviceToken can bypass shared authentication rate limiting. This issue affects versions up to 2026.3.28 and is fixed in version 2026.3.31. The vulnerability mainly impacts deployments using weak shared passwords, as strong shared tokens remain resistant to brute force attacks.

OpenClaw versions up to 2026.3.28 have a vulnerability where the host execution environment sanitization fails to properly filter certain environment variables related to package, registry, Docker, compiler, and TLS overrides. This issue was addressed and fixed in version 2026.3.31. The vulnerability has a medium severity rating with a CVSS score of 6.5.

OpenClaw versions up to 2026.3.28 have an information disclosure vulnerability in the Gateway Control Interface. This flaw allows exposure of version and assistant agent ID via the Control UI bootstrap JSON, which is considered low-severity fingerprinting or information disclosure. The issue is fixed in version 2026.3.31.