AIVirusDB
Menu
SearchTeam launch updates

vulnerability · openclaw

Feishu tools could ignore per-account disablement

Feishu tools could ignore per-account disablement. GitHub Advisory Database identifies npm package @openclaw/feishu < 2026.6.9-beta.1 as affected.

high severityconfirmed confidencepatchedNo known exploitation

Quick answer

What defenders need to know

What is it?
Feishu tools could ignore per-account disablement. GitHub Advisory Database identifies npm package @openclaw/feishu < 2026.6.9-beta.1 as affected.
Who is affected?
@openclaw/feishu @openclaw/feishu < 2026.6.9-beta.1
What should defenders do?
Upgrade @openclaw/feishu to 2026.6.9 or later.
Is a fix available?
Yes. Upgrade to 2026.6.9.

01 / Response

What to do

  1. Upgrade @openclaw/feishu to 2026.6.9 or later.
  2. Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed.

02 / Technical assessment

Evidence-backed analysis

OpenClaw's official security advisory assigns high severity with CVSS 8.1 and references CWE-863.

  • Official advisory: Feishu tools could ignore per-account disablement.
  • GitHub Advisory Database REST vulnerabilities[0]: package.ecosystem = npm; package.name = @openclaw/feishu; vulnerable_version_range = < 2026.6.9-beta.1; first_patched_version = 2026.6.9.
  • Source updated_at: 2026-09-03T17:30:56Z; withdrawn_at: null when checked on 2026-10-19T17:55:31Z. This check covers package identity and version fields only.

How to interpret evidence and confidence

03 / Timeline

Disclosure timeline

  1. Advisory published

    OpenClaw published GHSA-2q7j-2vhx-56g8.

04 / Standards crosswalk

Standards crosswalk

FrameworkControl IDStatusEvidence
Control IDCWE-863weakness reference
StatusSupported
Evidencecwe:CWE-863 (opens in a new tab)advisory:GHSA-2q7j-2vhx-56g8 (opens in a new tab)

05 / Primary sources

Source record

OpenClawOpenClaw Security Advisory GHSA-2q7j-2vhx-56g8https://github.com/openclaw/openclaw/security/advisories/GHSA-2q7j-2vhx-56g8Retrieved Aug 22, 2026 ↗
GitHub Advisory DatabaseGitHub Advisory Database GHSA-2q7j-2vhx-56g8https://github.com/advisories/GHSA-2q7j-2vhx-56g8Retrieved Oct 19, 2026 ↗
CC BY 4.0

Changes: AIVirusDB corrected the package-scoped affected range and rewrote the summary using GitHub Advisory Database version facts. No independent reproduction or GitHub endorsement is claimed.

Source facts: severity and affected versions are reported by the GitHub Advisory Database (GHSA).

AIVirusDB analysis: rewritten summaries, classification and prioritization are separate from the source data. These modifications do not imply endorsement by the source or independent reproduction by AIVirusDB.