clawdbot (npm)
Advisories
8
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2026.2.14 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install clawdbot@2026.2.14yarn
yarn add clawdbot@2026.2.14pnpm
pnpm add clawdbot@2026.2.14Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mj5r-hh7j-4gxf OpenClaw Telegram allowlist authorization accepted mutable usernames |
Medium EPSS 0.24% |
<= 2026.1.24-3 | No fix yet |
| GHSA-rq6g-px6m-c248 OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting |
High EPSS 0.34% |
<= 2026.1.24-3 | No fix yet |
| GHSA-3fqr-4cg8-h96q OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints |
High EPSS 0.16% |
<= 2026.1.24-3 | No fix yet |
| GHSA-q447-rj3r-2cgh OpenClaw affected by denial of service via unbounded webhook request body buffering |
High EPSS 0.51% |
<= 2026.1.24-3 | No fix yet |
| GHSA-h89v-j3x9-8wqj OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) |
Medium EPSS 0.38% |
<= 2026.1.24-3 | No fix yet |
| GHSA-w2cg-vxx6-5xjg OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks |
High EPSS 0.31% |
<= 2026.1.24-3 | No fix yet |
| GHSA-g34w-4xqq-h79m OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities |
Medium EPSS 0.32% |
< 2026.2.14 | 2026.2.14 |
| GHSA-chm2-m3w2-wcxm OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch |
Low | <= 2026.1.24-3 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor