Security advisories

medium2026-03-03

CVE-2025-59060-Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch

apache/ranger · GHSA-5fvg-qwcp-r325

low2026-03-03

CVE-2026-3449-@tootallnate/once vulnerable to Incorrect Control Flow Scoping

tootallnate/once · GHSA-vpq2-c234-7xj6

low2026-03-03

CVE-2026-3455-mailparser vulnerable to Cross-site Scripting

nodemailer/mailparser · GHSA-7gmj-h9xc-mcxc

medium2026-03-03

CVE-2026-32016-OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

openclaw/openclaw · GHSA-7f4q-9rqh-x36p

high2026-03-03

CVE-2026-32003-OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)

openclaw/openclaw · GHSA-2fgq-7j6h-9rm4

high2026-03-03

CVE-2026-32014-OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy

openclaw/openclaw · GHSA-r65x-2hqr-j5hf

medium2026-03-03

OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state

openclaw/openclaw · GHSA-6g25-pc82-vfwp

medium2026-03-03

OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

openclaw/openclaw · GHSA-5847-rm3g-23mw

medium2026-03-03

CVE-2026-32024-OpenClaw's avatar symlink traversal can expose out-of-workspace local files

openclaw/openclaw · GHSA-rx3g-mvc3-qfjf

medium2026-03-02

CVE-2026-32038-OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

openclaw/openclaw · GHSA-ww6v-v748-x7g9

high2026-03-02

CVE-2026-27545-OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind

openclaw/openclaw · GHSA-f7ww-2725-qvw2

high2026-03-02

CVE-2026-27522-OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset

openclaw/openclaw · GHSA-fqcm-97m6-w7rm

medium2026-03-02

CVE-2026-32065-OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

openclaw/openclaw · GHSA-hwpq-rrpf-pgcq

high2026-03-02

OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval

openclaw/openclaw · GHSA-943q-mwmv-hhvh

critical2026-03-02

CVE-2026-28466-OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway

openclaw/openclaw · GHSA-gv46-4xfq-jv58

medium2026-03-02

CVE-2026-28486-OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands

openclaw/openclaw · GHSA-v892-hwpg-jwqp

medium2026-03-02

CVE-2026-28457-OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace

openclaw/openclaw · GHSA-xw4p-pw82-hqr7

high2026-03-02

CVE-2026-28464-OpenClaw has non-constant-time token comparison in hooks authentication

openclaw/openclaw · GHSA-jmm5-fvh5-gf4p

medium2026-03-02

CVE-2026-28475-OpenClaw: Config writes could persist resolved ${VAR} secrets to disk

openclaw/openclaw · GHSA-47q7-97xp-m272

high2026-03-02

CVE-2026-28453-OpenClaw has Zip Slip path traversal in tar archive extraction

openclaw/openclaw · GHSA-p25h-9q54-ffvw