Threats affecting pkg:npm/OpenClaw

OpenClaw versions up to 2026.3.28 have an incomplete host environment security policy that allows an untrusted model to override compiler binary environment variables (such as CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) during approved host execution requests. This vulnerability is mitigated in version 2026.3.31 and later. Exploitation requires an approved host-exec request within the existing execution trust domain, limiting the severity to medium.

CVE-2026-41352 is a high-severity vulnerability in the openclaw npm package where a device-paired node can bypass the node scope gate, potentially allowing remote code execution on the host. Versions up to 2026.3.28 are affected. The issue is fixed in version 2026.3.31.

OpenClaw versions up to 2026.3.28 contain a vulnerability (CVE-2026-41351) that allows bypassing Telnyx webhook replay detection due to Base64 signature re-encoding issues. The flaw causes replay hashing to treat equivalent Telnyx Base64 and Base64URL signatures as distinct, enabling replay attacks despite signature verification still functioning. The issue is fixed in version 2026.3.31.

OpenClaw versions up to 2026.3.28 perform Discord audio preflight transcription before member authorization, which can lead to resource consumption prior to access control. This issue was addressed in version 2026.3.31. The vulnerability is rated medium severity with a CVSS score of 5.3 and does not impact confidentiality or integrity but may affect availability.

OpenClaw versions prior to 2026.3.31 have a vulnerability where HTTP operator endpoints lack browser-origin validation in trusted-proxy mode. This creates a Cross-Site Request Forgery (CSRF) risk when identity-bearing trusted-proxy browser deployments are used. The issue is not critical because it depends on specific deployment models rather than the shared-secret HTTP operator model. The vulnerability is fixed in version 2026.3.31.

OpenClaw versions prior to 2026.3.31 have a vulnerability in the MS Teams webhook implementation where the webhook parses the JSON body before validating the JWT token. This flaw allows unauthenticated attackers to cause resource exhaustion by sending crafted requests. The issue is fixed in version 2026.3.31.

OpenClaw Mirror Sync versions up to 2026.3.28 contain a sandbox escape vulnerability due to unrestricted file synchronization combined with symlink traversal. This allows an attacker with limited privileges to break out of the sandbox environment. The issue is fixed in version 2026.3.31 and later.

OpenClaw versions up to 2026.3.28 allow a workspace .env file to override the bundled plugin trust root directory, potentially enabling an attacker with control over the workspace to influence plugin loading. This vulnerability is rated high severity with a CVSS score of 7.8. The issue is fixed in version 2026.3.31.

CVE-2026-41377 is a vulnerability in the OpenClaw npm package where a security scan failure does not block plugin installation, resulting in a fail-open condition. This issue affects versions up to 2026.3.28 and was fixed in version 2026.3.31. The vulnerability requires user interaction to install an untrusted plugin despite the scan failure being visible. The severity is rated medium with a CVSS score of 4.6.

OpenClaw versions up to 2026.3.28 contain a vulnerability in the SSH sandbox tar upload functionality where symlinks are followed, allowing an attacker to write arbitrary files on the remote host. This issue is fixed in version 2026.3.31. The vulnerability has a high severity rating and a CVSS score of 8.1.

OpenClaw versions up to 2026.3.28 have a vulnerability where Microsoft Teams thread history accessed via the Graph API bypasses sender allowlists. This issue allows thread history to be fetched without proper sender filtering. The vulnerability is fixed in version 2026.3.31.

The OpenClaw LINE webhook handler in versions up to 2026.3.28 lacks a shared pre-auth concurrency budget before signature verification. This flaw can cause transient availability loss but does not impact confidentiality or integrity. The issue is fixed in version 2026.3.31.

OpenClaw versions up to 2026.3.28 contain a vulnerability where the Matrix thread root and reply context bypass sender allowlists. This allows unauthorized senders to bypass intended restrictions. The issue is fixed in version 2026.3.31.

OpenClaw versions up to 2026.3.28 allow a workspace .env file to override the bundled hooks root directory, enabling loading of attacker-controlled hook code. This vulnerability is fixed in version 2026.3.31. The flaw can lead to high impact including confidentiality, integrity, and availability compromise.

OpenClaw versions up to 2026.3.28 have a vulnerability where Feishu thread history and quoted messages bypass the sender allowlist, potentially allowing unauthorized message context access. This issue is fixed in version 2026.3.31.

OpenClaw versions prior to 2026.3.31 contain a vulnerability in the Zalo webhook replay cache that allows a cross-target messageId scope bypass. This issue affects authenticated sibling-target delivery paths but does not extend to unauthenticated attackers. The vulnerability has been assigned CVE-2026-41402 and is rated as medium severity with a CVSS score of 4.2. A fix is available in version 2026.3.31.

OpenClaw versions up to 2026.3.28 have a vulnerability where the Nostr privateKey is modeled as a plain string, allowing config views to expose the plaintext signing key via config.get. This redaction bypass leaks sensitive private key material. The issue is fixed in version 2026.3.31.

The OpenClaw package versions up to 2026.3.28 contain a vulnerability where the environment variables PIP_INDEX_URL and UV_INDEX_URL can bypass host execution environment sanitization. This allows redirection of Python package-index traffic, potentially enabling unauthorized or malicious package management operations. The issue is fixed in version 2026.3.31.

CVE-2026-41337 is a vulnerability in the OpenClaw npm package affecting versions up to 2026.3.28. It involves the mutation of the Plivo callback origin during voice-call replay processing before the replay is rejected. The issue has a medium severity with a CVSS score of 5.3 and is fixed in version 2026.3.31.

OpenClaw versions up to 2026.3.28 have a vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime scopes, potentially allowing elevated privileges within plugin routes. This issue is limited to plugin routes that interact with privileged runtime actions before plugin authentication completes. The vulnerability has been assigned CVE-2026-41394 and is rated high severity with a CVSS score of 8.2. A fix is available in version 2026.3.31 and later.