{"schema_version":1,"name":"AIVirusDB public threat intelligence","description":"Evidence-backed public intelligence for AI agent ecosystems.","canonical_url":"https://www.aivirusdb.com/threats.json","updated_at":"2026-10-16T05:15:13.630905Z","total_records":27,"records":[{"id":"intel-c41a4a579224bf9408c49d48","slug":"openclaw-qqbot-pre-dispatch-slash-commands-could-skip-allowfrom-checks-71e918ad","title":"OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"project:openclaw-core","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"ecosystem:openclaw","assigned_by":"relation","source_tag":"project:openclaw-core"}],"summary":"A vulnerability in the OpenClaw QQBot component allows slash commands to be dispatched before the configured allowFrom policy is applied, potentially bypassing access controls.","technical_summary":"When the QQBot slash-command feature is enabled and its invocation path is reachable, pre-dispatch handling can process a slash command before applying the configured allowFrom sender policy. This is a sender-authorization bypass in command handling, not evidence of arbitrary shell execution or a system-prompt takeover. Severity High follows the GitHub Advisory Database (https://github.com/advisories/GHSA-77pv-3w4q-vrj5); the original OpenClaw repository advisory rates it Medium. The reviewed advisories do not establish observed exploitation.","recommended_actions":["Upgrade to version 2026.4.27 or later.","Restrict QQBot slash command exposure until the patch is applied.","Maintain narrow channel and tool allowlists.","Avoid sharing a single Gateway between mutually untrusted users.","Disable the QQBot slash command feature if it is not required."],"severity":"high","confidence":"high","published_at":"2026-07-02T16:56:24Z","updated_at":"2026-10-16T05:15:13.630905Z","disclosed_at":"2026-05-28T17:39:52Z","last_verified_at":"2026-10-16T05:15:13.630905Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.4.26"],"fixed_versions":["2026.4.27"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-77pv-3w4q-vrj5","CVE-2026-53834"],"cwes":[],"risk_score":44,"risk_score_version":1,"public_disclosure_level":"public","notification_policy":"archive_only","sources":[{"title":"OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks","url":"https://github.com/advisories/GHSA-77pv-3w4q-vrj5","publisher":"github_ghsa_graphql","retrieved_at":"2026-09-24T16:53:23.903353Z","content_sha256":"0289a9a448350f73ef928881630d125d4d6dd58656d3ad21d5b368f339ef95b5"}],"evidence_summary":["QQBot pre-dispatch slash commands could skip allowFrom checks in OpenClaw versions <= 2026.4.26."],"timeline":[{"date":"2026-05-28T17:39:52Z","label":"Original advisory disclosure","description":"Original repository advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-77pv-3w4q-vrj5"},{"date":"2026-07-02T16:56:24Z","label":"Advisory database publication","description":"OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks"}],"standards_crosswalk":[],"url":"https://www.aivirusdb.com/threats/openclaw-qqbot-pre-dispatch-slash-commands-could-skip-allowfrom-checks-71e918ad/"},{"id":"intel-0456a74e3afbc5f11a0bc229","slug":"openclaw-webhook-rotation-could-leave-a-stale-secret-window-49d83880","title":"OpenClaw webhook rotation could leave a stale-secret window","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"project:openclaw-core","assigned_by":"reviewer"},{"tag":"threat:cve","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"ecosystem:openclaw","assigned_by":"relation","source_tag":"project:openclaw-core"}],"summary":"Affected Slack and Zalo channel runtimes could accept an old webhook secret after secrets reload. Events could therefore be accepted briefly after an operator expected revocation.","technical_summary":"Exposure requires the affected channel and knowledge of a previous secret. This concerns OpenClaw channel secret refresh, not a demonstrated compromise of Slack or Zalo. No observed exploitation is established by this source.","recommended_actions":["Upgrade OpenClaw to 2026.4.22 or later.","Until patched, restart the affected channel runtime after rotating webhook secrets. Restrict channel access and disable unused channels."],"severity":"medium","confidence":"high","published_at":"2026-07-02T17:11:03Z","updated_at":"2026-10-05T11:54:56.385056Z","disclosed_at":"2026-05-28T17:40:10Z","last_verified_at":"2026-10-05T11:54:56.385056Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.4.21"],"fixed_versions":["2026.4.22"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-275c-xpvc-jgfw","CVE-2026-53830"],"cwes":[],"risk_score":34,"risk_score_version":1,"public_disclosure_level":"public","notification_policy":"archive_only","sources":[{"title":"OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload","url":"https://github.com/advisories/GHSA-275c-xpvc-jgfw","publisher":"github_ghsa_graphql","retrieved_at":"2026-09-24T16:53:23.898484Z","content_sha256":"ced9bb4af506b5a9febd81a4dc99af18cc2a7ee786a853a902d2bc7a31f36839"}],"evidence_summary":["Affected Slack and Zalo channel runtimes could accept an old webhook secret after secrets reload. Events could therefore be accepted briefly after an operator expected revocation."],"timeline":[{"date":"2026-07-02T17:11:03Z","label":"GitHub Advisory Database publication","description":"OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload"}],"standards_crosswalk":[],"url":"https://www.aivirusdb.com/threats/openclaw-webhook-rotation-could-leave-a-stale-secret-window-49d83880/"},{"id":"intel-171b563f9bc26b5b5c9ac34e","slug":"openclaw-browser-actions-could-bypass-private-network-navigation-checks-3089a568","title":"OpenClaw browser actions could bypass private-network navigation checks","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"project:openclaw-core","assigned_by":"reviewer"},{"tag":"threat:cve","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"ecosystem:openclaw","assigned_by":"relation","source_tag":"project:openclaw-core"}],"summary":"Some browser interactions could navigate beyond the initial private-network check. An authenticated caller with browser evaluation capability could read content that direct navigation policy would block.","technical_summary":"This requires enabled browser control and an authenticated caller interacting with an untrusted page. It is a browser navigation-policy issue, not an authentication bypass. The source does not establish observed exploitation.","recommended_actions":["Upgrade OpenClaw to 2026.5.18 or later.","Until patched, limit browser control to trusted operators and avoid untrusted pages in environments with sensitive private web services."],"severity":"medium","confidence":"high","published_at":"2026-07-02T16:00:03Z","updated_at":"2026-10-05T11:54:56.385056Z","disclosed_at":"2026-05-28T17:39:04Z","last_verified_at":"2026-10-05T11:54:56.385056Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["< 2026.5.18"],"fixed_versions":["2026.5.18"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-2hfg-4fh4-qp7f","CVE-2026-53812"],"cwes":[],"risk_score":34,"risk_score_version":1,"public_disclosure_level":"public","notification_policy":"archive_only","sources":[{"title":"OpenClaw's browser act interactions could bypass private-network navigation checks","url":"https://github.com/advisories/GHSA-2hfg-4fh4-qp7f","publisher":"github_ghsa_graphql","retrieved_at":"2026-09-24T16:53:23.916920Z","content_sha256":"cf529e9e6eb57adc03ca7e9c5d74d9b6fda02a0fbc4a006bc6cce3f7d208dc29"}],"evidence_summary":["Some browser interactions could navigate beyond the initial private-network check. An authenticated caller with browser evaluation capability could read content that direct navigation policy would block."],"timeline":[{"date":"2026-07-02T16:00:03Z","label":"GitHub Advisory Database publication","description":"OpenClaw's browser act interactions could bypass private-network navigation checks"}],"standards_crosswalk":[],"url":"https://www.aivirusdb.com/threats/openclaw-browser-actions-could-bypass-private-network-navigation-checks-3089a568/"},{"id":"intel-f3f0b9aa930e7b67e1e52f17","slug":"openclaw-workspace-configuration-could-alter-dependency-setup-32388e62","title":"OpenClaw workspace configuration could alter dependency setup","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"project:openclaw-core","assigned_by":"reviewer"},{"tag":"threat:cve","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"ecosystem:openclaw","assigned_by":"relation","source_tag":"project:openclaw-core"}],"summary":"A workspace environment file could influence executable selection during bundled dependency setup. Exposure depends on a trusted operator opening the workspace and lower-trust configuration reaching that feature.","technical_summary":"This is a workspace trust-boundary issue in dependency setup, not evidence of a malicious package or an MCP vulnerability. The advisory does not establish unauthenticated remote access or observed exploitation.","recommended_actions":["Upgrade OpenClaw to 2026.4.29 or later.","Until patched, install bundled runtime dependencies only from trusted workspaces. Disable the affected feature if it is not needed."],"severity":"high","confidence":"high","published_at":"2026-06-18T20:33:54Z","updated_at":"2026-10-05T11:54:56.385056Z","disclosed_at":"2026-05-28T17:39:58Z","last_verified_at":"2026-10-05T11:54:56.385056Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["< 2026.4.29"],"fixed_versions":["2026.4.29"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-24vr-rprv-67rf","CVE-2026-53846"],"cwes":[],"risk_score":44,"risk_score_version":1,"public_disclosure_level":"public","notification_policy":"archive_only","sources":[{"title":"OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install","url":"https://github.com/advisories/GHSA-24vr-rprv-67rf","publisher":"github_ghsa_graphql","retrieved_at":"2026-09-24T16:53:23.925372Z","content_sha256":"a28dc32864071b5574f7a336248b3fe68e6672518ee71998be432723b671246f"}],"evidence_summary":["A workspace environment file could influence executable selection during bundled dependency setup. Exposure depends on a trusted operator opening the workspace and lower-trust configuration reaching that feature."],"timeline":[{"date":"2026-06-18T20:33:54Z","label":"GitHub Advisory Database publication","description":"OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install"}],"standards_crosswalk":[],"url":"https://www.aivirusdb.com/threats/openclaw-workspace-configuration-could-alter-dependency-setup-32388e62/"},{"id":"BYK-GHSA-3fp5-v549-9v66","slug":"ghsa-3fp5-v549-9v66","title":"flock wrapper could bypass durable exec approval binding","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"flock wrapper could bypass durable exec approval binding. The official advisory identifies openclaw <= 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-706, CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:36:44Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:36:44Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.6.6"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-3fp5-v549-9v66"],"cwes":["CWE-706","CWE-863"],"cvss_score":8.8,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-3fp5-v549-9v66","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3fp5-v549-9v66","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: flock wrapper could bypass durable exec approval binding.","Affected range: <= 2026.6.6. First patched version: 2026.6.9."],"timeline":[{"date":"2026-06-30T00:36:44Z","label":"Advisory published","description":"OpenClaw published GHSA-3fp5-v549-9v66."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-706","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-706","advisory:GHSA-3fp5-v549-9v66"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-3fp5-v549-9v66"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-3fp5-v549-9v66/"},{"id":"BYK-GHSA-3pmr-x9g8-m55r","slug":"ghsa-3pmr-x9g8-m55r","title":"Discord guild actions could skip cross-provider requester authorization","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Discord guild actions could skip cross-provider requester authorization. The official advisory identifies openclaw = 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.1 and references CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:36:57Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:36:57Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["= 2026.6.6"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-3pmr-x9g8-m55r"],"cwes":["CWE-863"],"cvss_score":8.1,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-3pmr-x9g8-m55r","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3pmr-x9g8-m55r","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Discord guild actions could skip cross-provider requester authorization.","Affected range: = 2026.6.6. First patched version: 2026.6.9."],"timeline":[{"date":"2026-06-30T00:36:57Z","label":"Advisory published","description":"OpenClaw published GHSA-3pmr-x9g8-m55r."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-3pmr-x9g8-m55r"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-3pmr-x9g8-m55r/"},{"id":"BYK-GHSA-3x84-qq85-fj65","slug":"ghsa-3x84-qq85-fj65","title":"Browser CDP discovery could accept blocked WebSocket URLs","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Browser CDP discovery could accept blocked WebSocket URLs. The official advisory identifies openclaw < 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.5 and references CWE-284, CWE-918.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:15Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:15Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["< 2026.6.6"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-3x84-qq85-fj65"],"cwes":["CWE-284","CWE-918"],"cvss_score":8.5,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-3x84-qq85-fj65","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3x84-qq85-fj65","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Browser CDP discovery could accept blocked WebSocket URLs.","Affected range: < 2026.6.6. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:15Z","label":"Advisory published","description":"OpenClaw published GHSA-3x84-qq85-fj65."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-284","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-284","advisory:GHSA-3x84-qq85-fj65"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-918","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-918","advisory:GHSA-3x84-qq85-fj65"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-3x84-qq85-fj65/"},{"id":"BYK-GHSA-52xj-c9p8-78cv","slug":"ghsa-52xj-c9p8-78cv","title":"MCP loopback could expose owner-only tools to non-owner runs","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:mcp","assigned_by":"reviewer"},{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"MCP loopback could expose owner-only tools to non-owner runs. The official advisory identifies openclaw >= 2026.5.20, < 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.3 and references CWE-269, CWE-862.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:37:20Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:37:20Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw","mcp"],"affected_products":["openclaw"],"affected_versions":[">= 2026.5.20, < 2026.6.6"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":["MCP_CONFUSED_DEPUTY"],"advisory_ids":["GHSA-52xj-c9p8-78cv"],"cwes":["CWE-269","CWE-862"],"cvss_score":8.3,"risk_score":53,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-52xj-c9p8-78cv","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-52xj-c9p8-78cv","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: MCP loopback could expose owner-only tools to non-owner runs.","Affected range: >= 2026.5.20, < 2026.6.6. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:37:20Z","label":"Advisory published","description":"OpenClaw published GHSA-52xj-c9p8-78cv."}],"standards_crosswalk":[{"framework_id":"owasp-llm-2025","framework_version":"2025","control_id":"LLM06","relationship":"risk_alignment","mapping_status":"unverified","evidence_refs":[],"source_url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-269","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-269","advisory:GHSA-52xj-c9p8-78cv"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-862","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-862","advisory:GHSA-52xj-c9p8-78cv"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-52xj-c9p8-78cv/"},{"id":"BYK-GHSA-575v-8hfq-m3mc","slug":"ghsa-575v-8hfq-m3mc","title":"Sandbox bind mounts could bypass parent-directory denylist checks","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Sandbox bind mounts could bypass parent-directory denylist checks. The official advisory identifies openclaw < 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.4 and references CWE-22, CWE-59.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:59Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:59Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["< 2026.6.6"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-575v-8hfq-m3mc"],"cwes":["CWE-22","CWE-59"],"cvss_score":8.4,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-575v-8hfq-m3mc","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-575v-8hfq-m3mc","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Sandbox bind mounts could bypass parent-directory denylist checks.","Affected range: < 2026.6.6. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:59Z","label":"Advisory published","description":"OpenClaw published GHSA-575v-8hfq-m3mc."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-22","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-22","advisory:GHSA-575v-8hfq-m3mc"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-59","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-59","advisory:GHSA-575v-8hfq-m3mc"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-575v-8hfq-m3mc/"},{"id":"BYK-GHSA-7vrr-rp4x-4g76","slug":"ghsa-7vrr-rp4x-4g76","title":"Plugin install commands could allow non-owner persistence","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Plugin install commands could allow non-owner persistence. The official advisory identifies openclaw >= 2026.5.20, < 2026.6.9 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-269, CWE-862.","recommended_actions":["Upgrade openclaw to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:37:13Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:37:13Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":[">= 2026.5.20, < 2026.6.9"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":["SUPPLY_CHAIN"],"advisory_ids":["GHSA-7vrr-rp4x-4g76"],"cwes":["CWE-269","CWE-862"],"cvss_score":8.8,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-7vrr-rp4x-4g76","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7vrr-rp4x-4g76","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Plugin install commands could allow non-owner persistence.","Affected range: >= 2026.5.20, < 2026.6.9. First patched version: 2026.6.9."],"timeline":[{"date":"2026-06-30T00:37:13Z","label":"Advisory published","description":"OpenClaw published GHSA-7vrr-rp4x-4g76."}],"standards_crosswalk":[{"framework_id":"owasp-llm-2025","framework_version":"2025","control_id":"LLM03","relationship":"risk_alignment","mapping_status":"unverified","evidence_refs":[],"source_url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-269","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-269","advisory:GHSA-7vrr-rp4x-4g76"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-862","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-862","advisory:GHSA-7vrr-rp4x-4g76"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-7vrr-rp4x-4g76/"},{"id":"BYK-GHSA-9969-8g9h-rxwm","slug":"ghsa-9969-8g9h-rxwm","title":"Host exec environment filtering could allow Git ext transport","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Host exec environment filtering could allow Git ext transport. The official advisory identifies openclaw <= 2026.6.1 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-78, CWE-184.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:34Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:34Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.6.1"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-9969-8g9h-rxwm"],"cwes":["CWE-78","CWE-184"],"cvss_score":8.8,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-9969-8g9h-rxwm","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9969-8g9h-rxwm","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Host exec environment filtering could allow Git ext transport.","Affected range: <= 2026.6.1. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:34Z","label":"Advisory published","description":"OpenClaw published GHSA-9969-8g9h-rxwm."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-78","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-78","advisory:GHSA-9969-8g9h-rxwm"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-184","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-184","advisory:GHSA-9969-8g9h-rxwm"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-9969-8g9h-rxwm/"},{"id":"BYK-GHSA-fh38-965w-f6c3","slug":"ghsa-fh38-965w-f6c3","title":"WhatsApp group IDs could satisfy elevated sender allowlists","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"WhatsApp group IDs could satisfy elevated sender allowlists. The official advisory identifies openclaw >= 2026.3.22, < 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.3 and references CWE-287, CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:06Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:06Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":[">= 2026.3.22, < 2026.6.6"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-fh38-965w-f6c3"],"cwes":["CWE-287","CWE-863"],"cvss_score":8.3,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-fh38-965w-f6c3","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fh38-965w-f6c3","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: WhatsApp group IDs could satisfy elevated sender allowlists.","Affected range: >= 2026.3.22, < 2026.6.6. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:06Z","label":"Advisory published","description":"OpenClaw published GHSA-fh38-965w-f6c3."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-287","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-287","advisory:GHSA-fh38-965w-f6c3"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-fh38-965w-f6c3"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-fh38-965w-f6c3/"},{"id":"BYK-GHSA-hjr6-g723-hmfm","slug":"ghsa-hjr6-g723-hmfm","title":"Host exec environment filtering could miss interpreter startup variables","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Host exec environment filtering could miss interpreter startup variables. The official advisory identifies openclaw <= 2026.6.1 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-78, CWE-184.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:25Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:25Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.6.1"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-hjr6-g723-hmfm"],"cwes":["CWE-78","CWE-184"],"cvss_score":8.8,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-hjr6-g723-hmfm","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Host exec environment filtering could miss interpreter startup variables.","Affected range: <= 2026.6.1. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:25Z","label":"Advisory published","description":"OpenClaw published GHSA-hjr6-g723-hmfm."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-78","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-78","advisory:GHSA-hjr6-g723-hmfm"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-184","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-184","advisory:GHSA-hjr6-g723-hmfm"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-hjr6-g723-hmfm/"},{"id":"BYK-GHSA-jhfx-v2j8-x3m6","slug":"ghsa-jhfx-v2j8-x3m6","title":"OpenAI-compatible HTTP model overrides could miss admin authorization","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"OpenAI-compatible HTTP model overrides could miss admin authorization. The official advisory identifies openclaw <= 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 7.6 and references CWE-862, CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.8 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:36:01Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:36:01Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.6.6"],"fixed_versions":["2026.6.8"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-jhfx-v2j8-x3m6"],"cwes":["CWE-862","CWE-863"],"cvss_score":7.6,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-jhfx-v2j8-x3m6","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jhfx-v2j8-x3m6","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: OpenAI-compatible HTTP model overrides could miss admin authorization.","Affected range: <= 2026.6.6. First patched version: 2026.6.8."],"timeline":[{"date":"2026-06-30T00:36:01Z","label":"Advisory published","description":"OpenClaw published GHSA-jhfx-v2j8-x3m6."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-862","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-862","advisory:GHSA-jhfx-v2j8-x3m6"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-jhfx-v2j8-x3m6"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-jhfx-v2j8-x3m6/"},{"id":"BYK-GHSA-m38g-vpwj-mpg9","slug":"ghsa-m38g-vpwj-mpg9","title":"OpenShell mirror sync could follow remote symlink parents","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"OpenShell mirror sync could follow remote symlink parents. The official advisory identifies openclaw <= 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.4 and references CWE-59, CWE-367.","recommended_actions":["Upgrade openclaw to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:36:38Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:36:38Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.6.6"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-m38g-vpwj-mpg9"],"cwes":["CWE-59","CWE-367"],"cvss_score":8.4,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-m38g-vpwj-mpg9","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m38g-vpwj-mpg9","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: OpenShell mirror sync could follow remote symlink parents.","Affected range: <= 2026.6.6. First patched version: 2026.6.9."],"timeline":[{"date":"2026-06-30T00:36:38Z","label":"Advisory published","description":"OpenClaw published GHSA-m38g-vpwj-mpg9."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-59","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-59","advisory:GHSA-m38g-vpwj-mpg9"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-367","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-367","advisory:GHSA-m38g-vpwj-mpg9"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-m38g-vpwj-mpg9/"},{"id":"BYK-GHSA-mgvr-6gvw-3rgr","slug":"ghsa-mgvr-6gvw-3rgr","title":"Sandbox exec-server HTTP requests could reach internal networks","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Sandbox exec-server HTTP requests could reach internal networks. The official advisory identifies openclaw < 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 7.7 and references CWE-918.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:40Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:40Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["< 2026.6.6"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-mgvr-6gvw-3rgr"],"cwes":["CWE-918"],"cvss_score":7.7,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-mgvr-6gvw-3rgr","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgvr-6gvw-3rgr","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Sandbox exec-server HTTP requests could reach internal networks.","Affected range: < 2026.6.6. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:40Z","label":"Advisory published","description":"OpenClaw published GHSA-mgvr-6gvw-3rgr."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-918","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-918","advisory:GHSA-mgvr-6gvw-3rgr"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-mgvr-6gvw-3rgr/"},{"id":"BYK-GHSA-mm9g-83wh-mhwj","slug":"ghsa-mm9g-83wh-mhwj","title":"Isolated cron jobs could regain denied exec tools","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Isolated cron jobs could regain denied exec tools. The official advisory identifies openclaw >= 2026.6.1, < 2026.6.9 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-862, CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:45Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:45Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":[">= 2026.6.1, < 2026.6.9"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-mm9g-83wh-mhwj"],"cwes":["CWE-862","CWE-863"],"cvss_score":8.8,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-mm9g-83wh-mhwj","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mm9g-83wh-mhwj","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Isolated cron jobs could regain denied exec tools.","Affected range: >= 2026.6.1, < 2026.6.9. First patched version: 2026.6.9."],"timeline":[{"date":"2026-06-30T00:38:45Z","label":"Advisory published","description":"OpenClaw published GHSA-mm9g-83wh-mhwj."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-862","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-862","advisory:GHSA-mm9g-83wh-mhwj"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-mm9g-83wh-mhwj"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-mm9g-83wh-mhwj/"},{"id":"BYK-GHSA-p5xh-frrh-cmgj","slug":"ghsa-p5xh-frrh-cmgj","title":"MS Teams message actions could miss requester authorization","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"MS Teams message actions could miss requester authorization. The official advisory identifies openclaw >= 2026.4.12-beta.1, < 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 7.1 and references CWE-862, CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:39:06Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:39:06Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":[">= 2026.4.12-beta.1, < 2026.6.6"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-p5xh-frrh-cmgj"],"cwes":["CWE-862","CWE-863"],"cvss_score":7.1,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-p5xh-frrh-cmgj","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p5xh-frrh-cmgj","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: MS Teams message actions could miss requester authorization.","Affected range: >= 2026.4.12-beta.1, < 2026.6.6. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:39:06Z","label":"Advisory published","description":"OpenClaw published GHSA-p5xh-frrh-cmgj."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-862","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-862","advisory:GHSA-p5xh-frrh-cmgj"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-p5xh-frrh-cmgj"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-p5xh-frrh-cmgj/"},{"id":"BYK-GHSA-v4f6-x5g5-2g4g","slug":"ghsa-v4f6-x5g5-2g4g","title":"Native web search could ignore OpenClaw tool policy","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Native web search could ignore OpenClaw tool policy. The official advisory identifies openclaw >= 2026.5.28, < 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns medium severity with CVSS 4.3 and references CWE-284, CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"medium","confidence":"confirmed","published_at":"2026-06-30T00:38:21Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:21Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":[">= 2026.5.28, < 2026.6.6"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-v4f6-x5g5-2g4g"],"cwes":["CWE-284","CWE-863"],"cvss_score":4.3,"risk_score":40,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-v4f6-x5g5-2g4g","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v4f6-x5g5-2g4g","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Native web search could ignore OpenClaw tool policy.","Affected range: >= 2026.5.28, < 2026.6.6. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:21Z","label":"Advisory published","description":"OpenClaw published GHSA-v4f6-x5g5-2g4g."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-284","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-284","advisory:GHSA-v4f6-x5g5-2g4g"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-v4f6-x5g5-2g4g"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-v4f6-x5g5-2g4g/"},{"id":"BYK-GHSA-v7hx-r36p-f68m","slug":"ghsa-v7hx-r36p-f68m","title":"Message mutations could skip requester authorization","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Message mutations could skip requester authorization. The official advisory identifies openclaw = 2026.6.6 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 7.1 and references CWE-862, CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:36:52Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:36:52Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["= 2026.6.6"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-v7hx-r36p-f68m"],"cwes":["CWE-862","CWE-863"],"cvss_score":7.1,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-v7hx-r36p-f68m","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hx-r36p-f68m","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Message mutations could skip requester authorization.","Affected range: = 2026.6.6. First patched version: 2026.6.9."],"timeline":[{"date":"2026-06-30T00:36:52Z","label":"Advisory published","description":"OpenClaw published GHSA-v7hx-r36p-f68m."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-862","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-862","advisory:GHSA-v7hx-r36p-f68m"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-v7hx-r36p-f68m"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-v7hx-r36p-f68m/"},{"id":"BYK-GHSA-wgq8-x5wm-g4rw","slug":"ghsa-wgq8-x5wm-g4rw","title":"Plugin install wrappers could skip install policy","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Plugin install wrappers could skip install policy. The official advisory identifies openclaw >= 2026.6.5, < 2026.6.9 as affected.","technical_summary":"OpenClaw's official security advisory assigns medium severity with CVSS 4.9 and references CWE-863.","recommended_actions":["Upgrade openclaw to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"medium","confidence":"confirmed","published_at":"2026-06-30T00:37:07Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:37:07Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":[">= 2026.6.5, < 2026.6.9"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":["SUPPLY_CHAIN"],"advisory_ids":["GHSA-wgq8-x5wm-g4rw"],"cwes":["CWE-863"],"cvss_score":4.9,"risk_score":40,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-wgq8-x5wm-g4rw","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wgq8-x5wm-g4rw","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Plugin install wrappers could skip install policy.","Affected range: >= 2026.6.5, < 2026.6.9. First patched version: 2026.6.9."],"timeline":[{"date":"2026-06-30T00:37:07Z","label":"Advisory published","description":"OpenClaw published GHSA-wgq8-x5wm-g4rw."}],"standards_crosswalk":[{"framework_id":"owasp-llm-2025","framework_version":"2025","control_id":"LLM03","relationship":"risk_alignment","mapping_status":"unverified","evidence_refs":[],"source_url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-wgq8-x5wm-g4rw"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-wgq8-x5wm-g4rw/"},{"id":"BYK-GHSA-wxh3-g47h-q3mc","slug":"ghsa-wxh3-g47h-q3mc","title":"Host exec environment filtering could miss rustup startup variables","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"},{"tag":"project:openclaw-core","assigned_by":"reviewer"}],"summary":"Host exec environment filtering could miss rustup startup variables. The official advisory identifies openclaw <= 2026.6.2 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-94, CWE-184, CWE-426.","recommended_actions":["Upgrade openclaw to 2026.6.6 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:38:50Z","updated_at":"2026-09-16T14:09:28Z","disclosed_at":"2026-06-30T00:38:50Z","last_verified_at":"2026-09-16T14:09:28Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["openclaw"],"affected_versions":["<= 2026.6.2"],"fixed_versions":["2026.6.6"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-wxh3-g47h-q3mc"],"cwes":["CWE-94","CWE-184","CWE-426"],"cvss_score":8.8,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-wxh3-g47h-q3mc","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wxh3-g47h-q3mc","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"}],"evidence_summary":["Official advisory: Host exec environment filtering could miss rustup startup variables.","Affected range: <= 2026.6.2. First patched version: 2026.6.6."],"timeline":[{"date":"2026-06-30T00:38:50Z","label":"Advisory published","description":"OpenClaw published GHSA-wxh3-g47h-q3mc."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-94","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-94","advisory:GHSA-wxh3-g47h-q3mc"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-184","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-184","advisory:GHSA-wxh3-g47h-q3mc"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-426","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-426","advisory:GHSA-wxh3-g47h-q3mc"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-wxh3-g47h-q3mc/"},{"id":"AIV-GHSA-89xv-2j6f-qhc8","slug":"ghsa-89xv-2j6f-qhc8","title":"MCP Go HTTP servers can accept cross-site requests that trigger tools","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:mcp","assigned_by":"reviewer"},{"tag":"threat:confused-deputy","assigned_by":"reviewer"}],"summary":"A malicious website can send cross-site requests to an MCP Go server lacking authorization, potentially invoking tools with the server's authority.","technical_summary":"The affected HTTP transport omitted origin and content-type checks. Exposure is especially relevant to stateless or sessionless servers without authorization; this is not an SDK-wide claim of remote code execution.","recommended_actions":["Upgrade github.com/modelcontextprotocol/go-sdk to 1.4.1 or a later supported release; 1.4.1 requires Go 1.25 or later.","Configure authorization and origin protection before exposing an MCP HTTP server."],"severity":"high","confidence":"confirmed","published_at":"2026-03-18T14:55:37Z","updated_at":"2026-09-15T11:12:18Z","disclosed_at":"2026-03-18T14:55:37Z","last_verified_at":"2026-09-15T11:12:18Z","exploitation_status":"none","patch_status":"patched","ecosystems":["mcp"],"affected_products":["github.com/modelcontextprotocol/go-sdk"],"affected_versions":["github.com/modelcontextprotocol/go-sdk <= 1.4.0"],"fixed_versions":["github.com/modelcontextprotocol/go-sdk 1.4.1"],"primary_category":"MCP_CONFUSED_DEPUTY","secondary_categories":[],"advisory_ids":["GHSA-89xv-2j6f-qhc8","CVE-2026-33252"],"cwes":["CWE-352"],"cvss_score":7.1,"risk_score":47,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"Model Context Protocol advisory GHSA-89xv-2j6f-qhc8","url":"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-89xv-2j6f-qhc8","publisher":"Model Context Protocol","retrieved_at":"2026-09-15T11:12:18Z"}],"evidence_summary":["Maintainer confirms missing HTTP request validation and the patched release.","AIVirusDB maps the delegated tool-authority abuse to MCP confused deputy; field exploitation is not verified."],"timeline":[{"date":"2026-03-18T14:55:37Z","label":"Advisory published","description":"Maintainer disclosed GHSA-89xv-2j6f-qhc8."},{"date":"2026-03-18T23:36:09Z","label":"Advisory revised","description":"Maintainer updated the source advisory."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-352","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-352","advisory:GHSA-89xv-2j6f-qhc8"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"owasp-llm-2025","framework_version":"2025","control_id":"LLM06","relationship":"risk_alignment","mapping_status":"unverified","evidence_refs":[],"source_url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-89xv-2j6f-qhc8/"},{"id":"AIV-GHSA-c67j-w6g6-q2cm","slug":"ghsa-c67j-w6g6-q2cm","title":"LangChain serialization can expose secrets through untrusted agent data","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"project:langchain","assigned_by":"reviewer"},{"tag":"threat:data-extraction","assigned_by":"reviewer"},{"tag":"threat:prompt-injection","assigned_by":"reviewer"}],"rag_architectures":["vector"],"rag_orchestration":["memory"],"rag_evidence":[{"dimension":"rag_architectures","value":"vector","source_url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm","rationale":"The advisory explicitly lists InMemoryVectorStore.load processing untrusted documents; this is conditional vector-store exposure."},{"dimension":"rag_orchestration","value":"memory","source_url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm","rationale":"The advisory explicitly lists RunnableWithMessageHistory as an affected serialization path."}],"summary":"Untrusted metadata can survive LangChain serialization as object instructions and expose environment secrets when vulnerable deserialization settings are used.","technical_summary":"The affected paths include streaming, message history and loading untrusted vector-store documents. Risk depends on processing attacker-controlled data, not simply installing LangChain.","recommended_actions":["Upgrade langchain-core to 0.3.81 on the 0.3 branch, or 1.2.5 on the 1.x branch; prefer a later supported release.","Keep environment-secret loading disabled and restrict deserialization to required object types."],"severity":"critical","confidence":"confirmed","published_at":"2025-12-23T01:44:38Z","updated_at":"2026-09-15T11:12:18Z","disclosed_at":"2025-12-23T01:44:38Z","last_verified_at":"2026-09-15T11:12:18Z","exploitation_status":"none","patch_status":"patched","ecosystems":[],"affected_products":["langchain-core"],"affected_versions":["langchain-core < 0.3.81","langchain-core >= 1.0.0, < 1.2.5"],"fixed_versions":["langchain-core 0.3.81","langchain-core 1.2.5"],"primary_category":"DATA_EXTRACTION","secondary_categories":["PROMPT_INJECTION"],"advisory_ids":["GHSA-c67j-w6g6-q2cm","CVE-2025-68664"],"cwes":[],"cvss_score":9.3,"risk_score":55,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"LangChain advisory GHSA-c67j-w6g6-q2cm","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm","publisher":"LangChain","retrieved_at":"2026-09-15T11:12:18Z"}],"evidence_summary":["Official advisory identifies unsafe serialization and environment-secret exposure.","No verified in-the-wild activity is established by this record."],"timeline":[{"date":"2025-12-23T01:44:38Z","label":"Advisory published","description":"Maintainer disclosed GHSA-c67j-w6g6-q2cm."},{"date":"2025-12-23T17:00:35Z","label":"Advisory revised","description":"Maintainer updated the source advisory."}],"standards_crosswalk":[{"framework_id":"owasp-llm-2025","framework_version":"2025","control_id":"LLM02","relationship":"risk_alignment","mapping_status":"unverified","evidence_refs":[],"source_url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/","mapper_version":1},{"framework_id":"owasp-llm-2025","framework_version":"2025","control_id":"LLM01","relationship":"risk_alignment","mapping_status":"unverified","evidence_refs":[],"source_url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-c67j-w6g6-q2cm/"},{"id":"AIV-GHSA-gr75-jv2w-4656","slug":"ghsa-gr75-jv2w-4656","title":"LangChain file-search agents can read beyond their configured directory","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"project:langchain","assigned_by":"reviewer"},{"tag":"threat:data-extraction","assigned_by":"reviewer"}],"summary":"Untrusted paths, search patterns or symlinks can bypass directory boundaries in LangChain agent middleware and configuration loaders, exposing files outside the intended root.","technical_summary":"Affected components do not consistently validate resolved paths. The maintainer reports no evidence of in-the-wild triggering; fully trusted inputs are outside the described exposure.","recommended_actions":["Upgrade langchain to 1.3.9 and langchain-anthropic to 1.4.6 where installed, or later supported patched releases.","Confine file tools to an isolated directory and do not allow dangerous loading of untrusted configuration."],"severity":"medium","confidence":"confirmed","published_at":"2026-06-12T16:56:12Z","updated_at":"2026-09-15T11:12:18Z","disclosed_at":"2026-06-12T16:56:12Z","last_verified_at":"2026-09-15T11:12:18Z","exploitation_status":"none","patch_status":"patched","ecosystems":[],"affected_products":["langchain","langchain-anthropic"],"affected_versions":["langchain <= 1.3.8","langchain-anthropic <= 1.4.5"],"fixed_versions":["langchain 1.3.9","langchain-anthropic 1.4.6"],"primary_category":"DATA_EXTRACTION","secondary_categories":[],"advisory_ids":["GHSA-gr75-jv2w-4656","CVE-2026-55443"],"cwes":["CWE-22","CWE-59"],"cvss_score":5.1,"risk_score":35,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"LangChain advisory GHSA-gr75-jv2w-4656","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-gr75-jv2w-4656","publisher":"LangChain","retrieved_at":"2026-09-15T11:12:18Z"}],"evidence_summary":["Official advisory identifies filesystem boundary failures in agent-executed components.","No RAG architecture is inferred from the presence of file-search functionality."],"timeline":[{"date":"2026-06-12T16:56:12Z","label":"Advisory published","description":"Maintainer disclosed GHSA-gr75-jv2w-4656."},{"date":"2026-06-16T22:21:40Z","label":"Advisory revised","description":"Maintainer updated the source advisory."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-22","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-22","advisory:GHSA-gr75-jv2w-4656"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-59","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-59","advisory:GHSA-gr75-jv2w-4656"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1},{"framework_id":"owasp-llm-2025","framework_version":"2025","control_id":"LLM02","relationship":"risk_alignment","mapping_status":"unverified","evidence_refs":[],"source_url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-gr75-jv2w-4656/"},{"id":"BYK-GHSA-2q7j-2vhx-56g8","slug":"ghsa-2q7j-2vhx-56g8","title":"Feishu tools could ignore per-account disablement","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"}],"summary":"Feishu tools could ignore per-account disablement. GitHub Advisory Database identifies npm package @openclaw/feishu < 2026.6.9-beta.1 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.1 and references CWE-863.","recommended_actions":["Upgrade @openclaw/feishu to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:36:15Z","updated_at":"2026-10-19T17:55:31Z","disclosed_at":"2026-06-30T00:36:15Z","last_verified_at":"2026-08-22T02:10:00Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["@openclaw/feishu"],"affected_versions":["@openclaw/feishu < 2026.6.9-beta.1"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-2q7j-2vhx-56g8"],"cwes":["CWE-863"],"cvss_score":8.1,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-2q7j-2vhx-56g8","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2q7j-2vhx-56g8","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"},{"title":"GitHub Advisory Database GHSA-2q7j-2vhx-56g8","url":"https://github.com/advisories/GHSA-2q7j-2vhx-56g8","publisher":"GitHub Advisory Database","retrieved_at":"2026-10-19T17:55:31Z","attribution":{"policy_ref":"ghsa-factual-summary-ccby4-v1","source_name":"GitHub Advisory Database","license_url":"https://creativecommons.org/licenses/by/4.0/","change_notice":"AIVirusDB corrected the package-scoped affected range and rewrote the summary using GitHub Advisory Database version facts. No independent reproduction or GitHub endorsement is claimed."}}],"evidence_summary":["Official advisory: Feishu tools could ignore per-account disablement.","GitHub Advisory Database REST vulnerabilities[0]: package.ecosystem = npm; package.name = @openclaw/feishu; vulnerable_version_range = < 2026.6.9-beta.1; first_patched_version = 2026.6.9.","Source updated_at: 2026-09-03T17:30:56Z; withdrawn_at: null when checked on 2026-10-19T17:55:31Z. This check covers package identity and version fields only."],"timeline":[{"date":"2026-06-30T00:36:15Z","label":"Advisory published","description":"OpenClaw published GHSA-2q7j-2vhx-56g8."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-2q7j-2vhx-56g8"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-2q7j-2vhx-56g8/"},{"id":"BYK-GHSA-w8wf-3qvj-6xqf","slug":"ghsa-w8wf-3qvj-6xqf","title":"Feishu permission tools could ignore per-account disablement","record_type":"vulnerability","schema_version":1,"taxonomy_version":"1.0.0","tag_schema_version":1,"tag_assignments":[{"tag":"ecosystem:openclaw","assigned_by":"reviewer"},{"tag":"threat:openclaw-exploit","assigned_by":"reviewer"}],"summary":"Feishu permission tools could ignore per-account disablement. GitHub Advisory Database identifies npm package @openclaw/feishu < 2026.6.9-beta.1 as affected.","technical_summary":"OpenClaw's official security advisory assigns high severity with CVSS 8.1 and references CWE-863.","recommended_actions":["Upgrade @openclaw/feishu to 2026.6.9 or later.","Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed."],"severity":"high","confidence":"confirmed","published_at":"2026-06-30T00:36:22Z","updated_at":"2026-10-19T17:55:31Z","disclosed_at":"2026-06-30T00:36:22Z","last_verified_at":"2026-08-22T02:10:00Z","exploitation_status":"none","patch_status":"patched","ecosystems":["openclaw"],"affected_products":["@openclaw/feishu"],"affected_versions":["@openclaw/feishu < 2026.6.9-beta.1"],"fixed_versions":["2026.6.9"],"primary_category":"OPENCLAW_EXPLOIT","secondary_categories":[],"advisory_ids":["GHSA-w8wf-3qvj-6xqf"],"cwes":["CWE-863"],"cvss_score":8.1,"risk_score":50,"risk_score_version":1,"public_disclosure_level":"public","sources":[{"title":"OpenClaw Security Advisory GHSA-w8wf-3qvj-6xqf","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w8wf-3qvj-6xqf","publisher":"OpenClaw","retrieved_at":"2026-08-22T02:10:00Z"},{"title":"GitHub Advisory Database GHSA-w8wf-3qvj-6xqf","url":"https://github.com/advisories/GHSA-w8wf-3qvj-6xqf","publisher":"GitHub Advisory Database","retrieved_at":"2026-10-19T17:55:31Z","attribution":{"policy_ref":"ghsa-factual-summary-ccby4-v1","source_name":"GitHub Advisory Database","license_url":"https://creativecommons.org/licenses/by/4.0/","change_notice":"AIVirusDB corrected the package-scoped affected range and rewrote the summary using GitHub Advisory Database version facts. No independent reproduction or GitHub endorsement is claimed."}}],"evidence_summary":["Official advisory: Feishu permission tools could ignore per-account disablement.","GitHub Advisory Database REST vulnerabilities[0]: package.ecosystem = npm; package.name = @openclaw/feishu; vulnerable_version_range = < 2026.6.9-beta.1; first_patched_version = 2026.6.9.","Source updated_at: 2026-09-03T17:33:20Z; withdrawn_at: null when checked on 2026-10-19T17:55:31Z. This check covers package identity and version fields only."],"timeline":[{"date":"2026-06-30T00:36:22Z","label":"Advisory published","description":"OpenClaw published GHSA-w8wf-3qvj-6xqf."}],"standards_crosswalk":[{"framework_id":"cwe","framework_version":"4.20","control_id":"CWE-863","relationship":"weakness_reference","mapping_status":"supported","evidence_refs":["cwe:CWE-863","advisory:GHSA-w8wf-3qvj-6xqf"],"source_url":"https://cwe.mitre.org/data/xml/cwec_v4.20.xml.zip","mapper_version":1}],"url":"https://www.aivirusdb.com/threats/ghsa-w8wf-3qvj-6xqf/"}]}