Zaloguj się
Deutsch English Español Polski
Wysoka

OpenClaw: QQBot media tags could read arbitrary local files through reply text

  • Ujawniono: 17.04.2026
  • Aktualizacja: 11.10.2026 10:22

Summary

QQBot media tags could read arbitrary local files through reply text.

Affected Packages / Versions

  • Package: openclaw
  • Ecosystem: npm
  • Affected versions: < 2026.4.10
  • Patched versions: >= 2026.4.10

Impact

QQBot outbound media tags in AI reply text could reference host-local paths outside the intended media storage boundary, allowing local file disclosure through outbound media handling.

Technical Details

The fix enforces the media storage boundary for all outbound QQBot local file paths.

Fix

The issue was fixed in #63271. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix.

Fix Commit(s)

  • 604777e4414cc3b2ff8861f18f4fb04374c702c6
  • PR: #63271

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting this issue.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka npm openclaw < 2026.4.10 2026.4.10

Odnośniki

Ocena CVSS -
Wektor CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Słabość (CWE)
CWE-22
Platforma
npm
Paczka
openclaw
Ujawniono
17.04.2026
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-66r7-m7xm-v49h - CC BY 4.0

Historia podatności: openclaw

Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (588) w archiwum
Wszystkich wpisów
588
Pierwsza → ostatnia
02.2026 07.2026
Bez poprawki
9
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 20
  • Wysoka 215
  • Średnia 299
  • Niska 54

Ujawnienia w latach

Istotność:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    Wysoka CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Wysoka · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Wysoka CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Wysoka CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    Wysoka · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Wysoka · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Wysoka · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    Wysoka · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Wysoka · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Wysoka · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Wysoka · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Krytyczna CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Wysoka · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    Wysoka CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Wysoka · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Wysoka · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Wysoka · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Wysoka · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Wysoka · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Wysoka · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Wysoka · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Wysoka · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    Wysoka CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    Wysoka · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    Wysoka · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Wysoka · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Wysoka · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    Wysoka · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Wysoka · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Wysoka · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    Wysoka · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Wysoka · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Wysoka · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Wysoka · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Wysoka · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Wysoka · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Wysoka · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Wysoka · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Wysoka · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Wysoka · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Wysoka · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  42. OpenClaw: Feishu webhook and card-action validation now fail closed
    Krytyczna · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  43. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Krytyczna · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  44. OpenClaw: QQBot media tags could read arbitrary local files through reply text ten wpis
    Wysoka CVE-2026-43533 < 2026.4.10 2026.4.10
  45. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Wysoka · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  46. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Wysoka · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  47. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Wysoka · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  48. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Wysoka · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  49. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Wysoka CVE-2026-43581 < 2026.4.10 2026.4.10
  50. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Wysoka · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  51. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Wysoka · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  52. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Wysoka · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  53. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Wysoka CVE-2026-43528 < 2026.4.14 2026.4.14
  54. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Wysoka CVE-2026-40037 < 2026.4.8 2026.4.8
  55. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Wysoka · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  56. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Wysoka CVE-2026-42427 < 2026.4.8 2026.4.8
  57. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Wysoka ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  58. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Wysoka ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  59. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Wysoka · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  60. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Wysoka · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
Pokaż więcej (20) Widać 60 z 235

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.