检索 GitHub Advisory Database 中的已审查与未审查安全公告。
| 公告编号 | 摘要 | 级别 | 生态 / 软件包 | 审查状态 | 发布时间 | 修改时间 |
|---|---|---|---|---|---|---|
| GHSA-WR92-6W3G-2HWC | Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-03-21 11:31 | 2026-03-28 04:15 |
当前筛选结果 998 条 · 时间按北京时间显示
| GHSA-W6F4-3V35-QJHJ |
Duplicate Advisory: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text 已撤回 |
| 中危 |
npmopenclaw |
| 已审查 |
| 2026-03-21 11:31 |
| 2026-03-25 03:05 |
| GHSA-QWMF-95R9-GX9X | Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-03-21 11:31 | 2026-03-25 02:05 |
| GHSA-Q94V-V6M9-JHQ9 | Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-21 11:31 | 2026-03-25 03:04 |
| GHSA-86JJ-29WC-7Q2W | Duplicate Advisory: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-21 11:31 | 2026-03-25 03:05 |
| GHSA-3P2X-HJXJ-C7RV | Duplicate Advisory: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-21 11:31 | 2026-03-25 03:04 |
| GHSA-X49Q-FHHM-R9JF | Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes 已撤回 | 严重 | npmopenclaw | 已审查 | 2026-03-20 23:31 | 2026-03-21 01:24 |
| GHSA-X6GF-MPR2-68H6 CVE-2026-4427 | Duplicate Advisory: pgproto3: Negative field length panics in DataRow.Decode 已撤回 | 高危 | Gogithub.com/jackc/pgproto3/v2 | 已审查 | 2026-03-19 23:31 | 2026-03-31 05:09 |
| GHSA-XRGV-34CC-Q765 | Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 00:25 |
| GHSA-X742-88JJ-7HV9 | Duplicate Advisory: allowlist exec-guard bypass via env -S 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 21:40 |
| GHSA-R849-826X-WGQM | Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage 已撤回 | 低危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 21:40 |
| GHSA-Q86M-697P-H7FH | Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 00:24 |
| GHSA-PFV5-RPCW-X34X | Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 00:25 |
| GHSA-JQPF-VJ28-9V7R | Duplicate Advisory: Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 21:55 |
| GHSA-H36M-2VH5-X699 | Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 22:20 |
| GHSA-GGM6-H3MX-CMMP | Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags 已撤回 | 低危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 03:15 |
| GHSA-G87J-GM7P-6VW2 | Duplicate Advisory: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 00:26 |
| GHSA-8PX5-2GFR-7PH6 | Duplicate Advisory: OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 03:14 |
| GHSA-866C-WWM5-4RJ7 | Duplicate Advisory: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 02:21 |
| GHSA-82GW-WQW6-R2CF | Duplicate Advisory: Command Injection via unescaped environment assignments in Windows Scheduled Task script generation 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 21:24 |
| GHSA-5RP4-CWGH-GVWQ | Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 00:27 |
| GHSA-5GQG-MQH5-2V39 | Duplicate Advisory: OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 03:13 |
| GHSA-5326-6F73-M96W | Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 02:21 |
| GHSA-44C9-4RG5-QJGQ | Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 21:39 |
| GHSA-3846-MFVC-XWPF | Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-03-19 11:30 | 2026-03-20 21:26 |