Threats tagged 'ghsa-jw7v-5mp7-ghgm'

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.6.6 contain a policy bypass vulnerability in the browser CDP discovery feature. This flaw allows acceptance of WebSocket URLs that should be blocked by OpenClaw policies, potentially enabling attackers with lower-trust access to reach restricted network destinations. The vulnerability is rated high severity with a CVSS score of 8.5. No known exploits have been reported in the wild. A patch is available to address this issue.