Threat Intelligence Database

A vulnerability exists in mf-yang openclaw-cn up to version 0.2.1 in the assertNoSymlinkEscape function of the apply_patch tool. This flaw allows remote attackers to manipulate link following, potentially leading to unauthorized actions. The vulnerability is identified as CWE-59 (link following). An exploit is publicly available, but no vendor response or patch has been issued yet.

CVE-2026-19008 is a medium severity vulnerability in the mf-yang openclaw-cn project up to version 0.2.1. It affects the assertNoSymlinkEscape function in the apply_patch tool, allowing link following manipulation. The vulnerability can be exploited remotely, and public exploit code exists. The project has been informed but has not yet responded or provided a fix.

A vulnerability in mf-yang openclaw-cn up to version 0.2.1 affects the isApprovedElevatedSender function in the src/auto-reply/reply/reply-elevated.ts file. This vulnerability involves improper privilege management and can be exploited remotely. The issue has been publicly disclosed, but the project has not yet responded or issued a fix.

CVE-2026-19007 is a medium severity vulnerability in mf-yang openclaw-cn versions 0.2.0 and 0.2.1. It involves improper privilege management in the isApprovedElevatedSender function, allowing remote attackers to exploit elevated privileges. The vulnerability has been publicly disclosed, but no official patch or vendor response is currently available.

CVE-2026-19006 is a vulnerability in mf-yang openclaw-cn 2026.2.5 affecting the Ggateway Exec Approval Flow component. It involves incorrect authorization due to manipulation in the src/agents/bash-tools.exec.ts file. The vulnerability can be exploited remotely and the exploit code has been publicly disclosed. The project has been notified but has not yet responded or issued a fix. The CVSS score is 6.3, indicating a medium severity impact.

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-17458 is a server-side request forgery (SSRF) vulnerability in the mf-yang openclaw-cn project affecting versions 0.2.0 and 0.2.1. The vulnerability exists in the clickViaPlaywright function of the Browser Control HTTP API component. It allows remote attackers to manipulate requests, potentially causing the server to make unintended requests. The vulnerability has a medium severity with a CVSS score of 5.3. The project has been informed but has not yet responded or issued a fix.

CVE-2026-17457 is an information disclosure vulnerability in the mf-yang openclaw-cn project affecting versions 0.2.0 and 0.2.1. The issue exists in the assertBrowserNavigationAllowed function within the src/browser/navigation-guard.ts file of the Scheme Handler component. Manipulating the url argument can lead to unintended information disclosure. The vulnerability can be exploited remotely without user interaction. The project has been informed but has not issued a response or fix. The CVSS 4.0 base score is 5.3, indicating medium severity.