Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

GHSA-vv65-f55v-xm6g HIGH about 1 month ago

## Summary The default git executor used for all worktree operations spawns `git` through a shell, and the untrusted task **branch** name flows in...

npm

No PRs yet

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

GHSA-gg9x-qcx2-xmrh CVE-2026-49852 HIGH about 1 month ago

### Summary `joserfc.jwt.decode` accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or `None...

pypi

No PRs yet

SFTPGo has stored XSS via inline parameter on public shares and user file download

GHSA-3vcg-pv95-pq54 CVE-2026-49245 LOW about 1 month ago

## Summary The inline query parameter on the browsable-share file download and on the authenticated user file download suppressed Content-Disposit...

go

No PRs yet

SFTPGo has path confinement bypass in public browsable share partial ZIP download

GHSA-h64p-8h4r-6gfh CVE-2026-49244 MODERATE about 1 month ago

## Summary The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entri...

go

No PRs yet

@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

GHSA-93q6-wwjh-jc6h CVE-2026-50290 MODERATE about 1 month ago

## Finding **Location**: `core/src/server/render-to-string.ts:307-311` CSS value sanitization stripped `expression(` and `url(javascript:` using ...

npm

No PRs yet

@asymmetric-effort/specifyjs: No redirect target validation in secureFetch

GHSA-j5qp-p44g-2m49 MODERATE about 1 month ago

## Finding **Location**: `core/src/shared/secure-fetch.ts` `assertSecureUrl` validated only the initial request URL. The `fetch()` API follows re...

npm

No PRs yet

@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction

GHSA-2944-57xv-2682 MODERATE about 1 month ago

## Finding **Location**: `core/src/shared/secure-fetch.ts:33-35` `data:` URIs were allowed without any restriction. While `data:` URIs don't make...

npm

No PRs yet

@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)

GHSA-xw57-23p8-9wc5 MODERATE about 1 month ago

## Finding **Location**: `core/src/shared/secure-fetch.ts:52-54` The localhost exception allowed `localhost` and `127.0.0.1` but did not cover `0...

npm

No PRs yet

@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

GHSA-qcr8-x557-7cp3 MODERATE about 1 month ago

## Finding **Location**: `core/src/core/scheduler.ts:23`, `core/src/hooks/dispatcher.ts:100`, `core/src/client/graphql.ts:71` Several `console.wa...

npm

No PRs yet

@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

GHSA-5c7w-4wm3-85vw MODERATE about 1 month ago

## Finding **Location**: `core/src/client/graphql.ts:66-80` The `gql` template tag function warned about interpolated values containing GraphQL m...

npm

No PRs yet

@asymmetric-effort/specifyjs: URL parse failure silently allows request

GHSA-8882-frvv-92w4 CVE-2026-50288 HIGH about 1 month ago

## Finding **Location**: `core/src/shared/secure-fetch.ts:42-45` When `new URL()` throws a parse error, the `assertSecureUrl` function returned w...

npm

No PRs yet

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

GHSA-7h62-6v23-v8fm CVE-2026-50284 HIGH about 1 month ago

## Summary `AssetsController::actionDeleteFolder()` only requires the `deleteAssets:<volume-uid>` permission for the target folder. It never enfor...

packagist

No PRs yet

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

GHSA-qh45-9g5p-m2v4 CVE-2026-50283 MODERATE about 1 month ago

We have identified an authorization issue in Craft CMS `AssetsController::actionReplaceFile` that can delete a source asset without source delete p...

packagist

No PRs yet

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

GHSA-43cq-c2gq-pfpw CVE-2026-50280 MODERATE about 1 month ago

### Summary The `EntriesController::actionMoveToSection()` endpoint checks only whether the current user can view the destination section, but it ...

packagist

No PRs yet

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

GHSA-qq2c-2q8j-jh27 CVE-2026-50279 HIGH about 1 month ago

### Summary `EntriesController::actionSaveEntry()` performs entry-edit permission checks before request-controlled author changes are applied to t...

packagist

No PRs yet

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

GHSA-m3cr-vc2j-pm27 CVE-2026-44454 HIGH about 1 month ago

# Command injection via dotfiles URI parameter combined with workspace auto-creation ## Summary The `dotfiles` registry module passed unsanitized...

go

No PRs yet

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

GHSA-4h7g-5542-v3fc CVE-2026-52854 HIGH about 1 month ago

### Summary Stored XSS through wikitext can be performed by inserting malicious HTML into the `overlays` parameter of the `display_map` parser func...

packagist

No PRs yet

Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

GHSA-gfhv-vqv2-4544 CVE-2026-52726 HIGH about 1 month ago

### Summary `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controll...

pypi

1

Dependabot PRs

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

GHSA-pmch-g965-grmr CVE-2026-50180 HIGH about 1 month ago

### Summary `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerat...

pypi

No PRs yet

Langroid: Path traversal in the file tools allows read/write outside configured current directory

GHSA-fg23-3346-88f5 CVE-2026-50181 HIGH about 1 month ago

### Summary Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir` as the intended working-directory boundary for file operation...

pypi

No PRs yet

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

GHSA-h5gx-45rj-2h5j CVE-2026-50192 MODERATE about 1 month ago

### Summary The Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey...

go

No PRs yet

OpenClaw: Native command authorization could skip owner-command enforcement

GHSA-p73f-w79w-jqr5 HIGH about 1 month ago

### Summary Native command authorization could skip owner-command enforcement. In affected versions, a sender able to trigger native command handl...

npm

No PRs yet

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

GHSA-j472-gf56-x589 HIGH about 1 month ago

### Summary PowerShell encoded-command aliases could miss exec allowlist checks. In affected versions, a command request using abbreviated encoded...

npm

No PRs yet

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

GHSA-77q5-rr5v-x43q HIGH about 1 month ago

### Summary Trusted retry endpoint checks could match hostname prefixes. In affected versions, a retry endpoint URL chosen by lower-trust input co...

npm

No PRs yet

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

GHSA-w5ww-7chg-mxcq HIGH about 1 month ago

### Summary Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram user able to invoke an affected callbac...

npm

No PRs yet

Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set

GHSA-3rjw-m598-pq24 CVE-2026-50185 MODERATE about 1 month ago

### Summary The aarch64 implementations of `Cmov` and `CmovEq` seem to assume that the high bits when loading a value of size smaller than a regis...

cargo

No PRs yet

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

GHSA-g3xr-5w5j-w4q4 CVE-2026-50149 MODERATE about 1 month ago

### Impact When an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.s...

go

No PRs yet

OpenClaw: Matrix allowFrom could bind to mutable display names

GHSA-7hxm-f538-3xp6 CVE-2026-53811 HIGH about 1 month ago

### Summary Matrix allowFrom could bind to mutable display names. In affected versions, a Matrix account able to change display name metadata coul...

npm

No PRs yet

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

GHSA-4m3v-q747-pc6h MODERATE about 1 month ago

### Summary Mattermost slash token revocation could lag until monitor refresh. In affected versions, a caller with an old Mattermost slash token d...

npm

No PRs yet

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

GHSA-3c6j-hq33-3jv4 CVE-2026-53816 HIGH about 1 month ago

### Summary OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that ...

npm

No PRs yet

OpenClaw: Combined POSIX shell options could confuse exec revalidation

GHSA-vxx3-6hc9-7cc3 CVE-2026-53806 HIGH about 1 month ago

### Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could...

npm

No PRs yet

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

GHSA-rj6p-xmxr-qj4h CVE-2026-53818 MODERATE about 1 month ago

### Summary MCP loopback could skip owner-only tool policy for non-owner callers. In affected versions, a non-owner caller reaching the affected l...

npm

No PRs yet

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

GHSA-275c-xpvc-jgfw MODERATE about 1 month ago

### Summary Slack and Zalo webhook secrets could remain active after secrets.reload. In affected versions, a caller with an old webhook secret dur...

npm

No PRs yet

OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

GHSA-3wqp-prf6-2m72 LOW about 1 month ago

### Summary Feishu dynamic-agent bindings could miss configWrites enforcement. In affected versions, a Feishu sender using dynamic-agent binding b...

npm

No PRs yet

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

GHSA-6c4r-g249-wv3c MODERATE about 1 month ago

### Summary Sandboxed session spawn could expose the real workspace path to child prompts. In affected versions, a child session spawned from a sa...

npm

No PRs yet

OpenClaw: Embedded runner policy could be confused by provider aliases

GHSA-p39j-x9h5-q66m CVE-2026-53809 MODERATE about 1 month ago

### Summary Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare pol...

npm

No PRs yet

OpenClaw: Fake package roots could influence memory-core artifact loading

GHSA-v8cx-933x-r976 CVE-2026-53813 HIGH about 1 month ago

### Summary Fake package roots could influence memory-core artifact loading. In affected versions, a local package root resolution path influenced...

npm

No PRs yet

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

GHSA-8wg3-5mcm-fjq8 CVE-2026-53819 HIGH about 1 month ago

### Summary Workspace .env could override Homebrew executable selection for skill install flows. In affected versions, a workspace `.env` in a rep...

npm

No PRs yet

OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

GHSA-77pv-3w4q-vrj5 MODERATE about 1 month ago

### Summary QQBot pre-dispatch slash commands could skip allowFrom checks. In affected versions, a QQBot sender able to invoke slash commands coul...

npm

No PRs yet

OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

GHSA-xr4f-mjxj-w6w5 HIGH about 1 month ago

### Summary The bundled device-pair plugin exposed `/pair` on normal chat command surfaces. In affected releases, authorized non-owner chat sender...

npm

No PRs yet

OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

GHSA-hcm3-8f6r-6xwg MODERATE about 1 month ago

### Summary Browser debug/export routes could reuse already-open blocked tabs. In affected versions, a caller that can reference an already-open b...

npm

No PRs yet

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

GHSA-grc3-2j34-p6gm MODERATE about 1 month ago

### Summary message.action forwarding could send Gateway credentials to model-supplied loopback URLs. In affected versions, model-controlled actio...

npm

No PRs yet

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

GHSA-w4v6-g3wm-w36c CRITICAL about 1 month ago

### Summary QQBot admin commands could skip DM-only and allowFrom policy. In affected versions, a QQBot sender able to trigger the exported comman...

npm

No PRs yet

OpenClaw: Mattermost handlers could fall open when channel type was missing

GHSA-gp79-m99v-gjmh MODERATE about 1 month ago

### Summary Mattermost handlers could fall open when channel type was missing. In affected versions, a Mattermost event missing channel type metad...

npm

No PRs yet

OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

GHSA-qjpc-qf9m-xwmr HIGH about 1 month ago

### Summary In trusted-proxy Control UI mode, OpenClaw accepted a WebSocket client's declared operator scopes before those scopes were bound to a ...

npm

No PRs yet

OpenClaw: Slack allowFrom could bind to mutable display names

GHSA-c29c-2q9c-pc86 HIGH about 1 month ago

### Summary Slack allowFrom could bind to mutable display names. In affected versions, a Slack account able to change display name metadata could ...

npm

No PRs yet

OpenClaw: Skill Workshop apply flow could override pending approval

GHSA-cqwv-9qjx-vxw2 MODERATE about 1 month ago

### Summary Skill Workshop apply flow could override pending approval. In affected versions, an agent tool call reaching the affected Skill Worksh...

npm

No PRs yet

OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

GHSA-jvm4-4j77-39p6 HIGH about 1 month ago

### Summary QQBot streaming command could mutate config without explicit allowFrom. In affected versions, a QQBot sender reaching the affected com...

npm

No PRs yet

OpenClaw: Node pairing reconnection could confuse approval scope state

GHSA-83w9-h5wv-j9xm HIGH about 1 month ago

### Summary Node pairing reconnection could confuse approval scope state. In affected versions, a paired or reconnecting node session could mutate...

npm

No PRs yet

OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions

GHSA-wv26-j37q-2g7p MODERATE about 1 month ago

### Summary Slack plugin approvals used the exec approver gate for plugin actions. In affected versions, a Slack user authorized only for exec app...

npm

No PRs yet