Threats tagged 'ghsa-767m-xrhc-fxm7'

A vulnerability in the openclaw npm package allows users with operator.write privileges to access admin-level Telegram configuration and cron persistence via the send function. This is an authenticated escalation of privilege with a narrower scope, rated medium severity by maintainers but high by CVSS. Versions prior to 2026.3.28 are affected, with a fix released in version 2026.3.28.