Threats tagged 'ghsa-hf7p-489h-xhj4'

OpenClaw versions prior to 2026.4.20 have a message classification vulnerability in Feishu card-action callbacks. This flaw causes direct messages to be misclassified as group conversations, allowing attackers to bypass direct message policy enforcement by triggering card-action flows that should be blocked. The vulnerability has a medium severity rating with a CVSS score of 5.4.