GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
9 advisories
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks
Low
GHSA-j4c5-89f5-f3pm
was published
for
openclaw
(npm)
Apr 25, 2026
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets
Moderate
CVE-2026-43576
was published
for
openclaw
(npm)
Apr 17, 2026
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy
Moderate
CVE-2026-42439
was published
for
openclaw
(npm)
Apr 17, 2026
OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval
Moderate
CVE-2026-42426
was published
for
openclaw
(npm)
Apr 9, 2026
OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard
Moderate
CVE-2026-42431
was published
for
openclaw
(npm)
Apr 9, 2026
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing
Moderate
CVE-2026-42422
was published
for
openclaw
(npm)
Apr 9, 2026
OpenClaw SSRF guard misses four IPv6 special-use ranges
Low
GHSA-g86v-f9qv-rh6m
was published
for
openclaw
(npm)
Mar 31, 2026
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override
Moderate
CVE-2026-41332
was published
for
openclaw
(npm)
Mar 31, 2026
OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
High
GHSA-jccr-rrw2-vc8h
was published
for
openclaw
(npm)
Mar 31, 2026
ProTip!
Advisories are also available from the
GraphQL API