Iniciar sesión
Deutsch English Español Polski
Media

OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

  • Publicada: 29.03.2026
  • Actualizado: 11.10.2026 10:22

Summary

ACP CLI approval prompt ANSI escape sequence injection

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: >= 2026.2.13, <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

ACP tool titles could previously carry ANSI control sequences into approval prompts and permission logs, letting untrusted tool metadata spoof terminal output. Commit 464e2c10a5edceb380d815adb6ff56e1a4c50f60 sanitizes tool titles at the source and broadens ANSI stripping to full CSI sequences.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 464e2c10a5edceb380d815adb6ff56e1a4c50f60.

Fix Commit(s)

  • 464e2c10a5edceb380d815adb6ff56e1a4c50f60

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm openclaw >= 2026.2.13, < 2026.3.28 2026.3.28

Referencias

Puntuación CVSS 4.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Debilidad (CWE)
CWE-116, CWE-150
Plataforma
npm
Paquete
openclaw
Publicada
29.03.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-4hmj-39m8-jwc7 - CC BY 4.0

Historial de vulnerabilidades: openclaw

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (588) en el archivo
Entradas en total
588
Primera → última
02.2026 07.2026
Sin corrección
9
Explotada en ataques
0

Distribución por gravedad

  • Crítica 20
  • Alta 215
  • Media 299
  • Baja 54

Divulgaciones por año

Gravedad:
  1. OpenClaw has ACP CLI approval prompt ANSI escape sequence injection esta entrada
    Media · 4.3 CVE-2026-35651 >= 2026.2.13, < 2026.3.28 2026.3.28
  2. OpenClaw: Native command authorization could skip owner-command enforcement
    Alta CVE-2026-53828 < 2026.5.6 2026.5.6
  3. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Alta · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  4. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Alta CVE-2026-53839 < 2026.5.7 2026.5.7
  5. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Alta CVE-2026-53807 < 2026.5.6 2026.5.6
  6. OpenClaw: Matrix allowFrom could bind to mutable display names
    Alta · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  7. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Alta · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  8. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Alta · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  9. OpenClaw: Fake package roots could influence memory-core artifact loading
    Alta · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  10. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Alta · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  11. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Alta · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  12. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Alta · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  13. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Crítica CVE-2026-34507 < 2026.4.29 2026.4.29
  14. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Alta · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  15. OpenClaw: Slack allowFrom could bind to mutable display names
    Alta CVE-2026-53823 < 2026.5.3 2026.5.3
  16. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Alta · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  17. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Alta · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  18. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Alta · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  19. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Alta · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  20. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Alta · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  21. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Alta · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  22. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Alta · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  23. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Alta · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  24. OpenClaw: Shell wrapper argv could change between approval and execution
    Alta CVE-2026-53822 < 2026.5.18 2026.5.18
  25. OpenClaw: Exec approval display truncation could hide the command being approved
    Alta · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  26. OpenClaw: Message read actions could skip channel allowlist checks
    Alta · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  27. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Alta · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  28. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Alta · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  29. OpenClaw: Discord allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  30. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Alta · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  31. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Alta · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  32. OpenClaw: Zalo allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  33. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Alta · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  34. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Alta · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  35. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Alta · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  36. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Alta · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  37. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Alta · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  38. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Alta · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  39. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Alta · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  40. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Alta · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  41. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Alta · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  42. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Alta · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  43. OpenClaw: Feishu webhook and card-action validation now fail closed
    Crítica · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  44. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Crítica · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  45. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Alta CVE-2026-43533 < 2026.4.10 2026.4.10
  46. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Alta · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  47. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Alta · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  48. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Alta · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  49. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Alta · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  50. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Alta CVE-2026-43581 < 2026.4.10 2026.4.10
  51. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Alta · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  52. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Alta · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  53. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Alta · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  54. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Alta CVE-2026-43528 < 2026.4.14 2026.4.14
  55. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Alta CVE-2026-40037 < 2026.4.8 2026.4.8
  56. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Alta · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  57. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Alta CVE-2026-42427 < 2026.4.8 2026.4.8
  58. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Alta ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  59. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Alta ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  60. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Alta · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  61. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Alta · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
Mostrar más (20) Mostrando 61 de 236

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.