https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for openclaw/openclaw en-us Tue, 11 Aug 2026 21:01:38 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/408 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/408 Tue, 11 Aug 2026 18:04:21 GMT Both the chrome-mcp accessibility snapshot builder and the CDP renderRoleTree function recursively walked the accessibility tree without an enforced depth limit. A malicious or pathologically-nested web page (e.g., tens of thousands of nested DOM elements) could cause the recursive traversal to overflow the call stack (RangeError: Maximum call stack size exceeded), crashing the browser automation/gateway process, or generate quadratically growing indentation output (hundreds of MB) before any truncation logic runs, exhausting memory. medium unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/395 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/395 Mon, 10 Aug 2026 10:06:33 GMT The Matrix plugin's 'permissions' action (used for verification-management operations like verification-bootstrap, which can reset cross-signing keys and set recovery keys) was gated only by an 'encryption' and 'verification' config flag, without checking whether the sender was actually the bot owner. Any Matrix user able to send messages/commands to the bot could invoke sensitive verification actions such as forcing a cross-signing reset or listing verification state, potentially compromising encryption trust or account security. The patch adds an explicit senderIsOwner check both when advertising the action in tool discovery and when dispatching it, throwing a ToolAuthorizationError for non-owners. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/392 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/392 Mon, 10 Aug 2026 05:51:53 GMT The memory-host SDK maintained its own stale SECRET_PATTERNS table for redacting sensitive data in error messages, which lacked coverage for payment card numbers, CVV codes, and other payment credentials that the canonical redactor (src/logging/redact.ts) covers. Additionally, ACP's error redaction depended on module load order via a fragile injection hook, and when operator-configured redactPatterns were non-empty they fully replaced (rather than extended) built-in provider-token patterns, causing default secret patterns to go unredacted. This meant sensitive data such as credit card numbers or provider tokens could leak unredacted into error logs/output at these security boundaries. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/393 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/393 Mon, 10 Aug 2026 05:52:35 GMT The MS Teams group message admission logic only fell back to the allowlist re-check when the sender access denial reason was exactly 'group_policy_not_allowlisted'. If the sender access group was missing or referenced an unsupported/unrecognized group type (e.g., a Discord-typed access group), the denial reason code would differ, causing the code to skip the deny path entirely and treat the message as admitted, allowing unauthorized senders' messages to be processed and persisted. The fix makes any '!senderAccess.allowed' result authoritative, ensuring fail-closed behavior regardless of the specific reason code. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/391 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/391 Sun, 09 Aug 2026 17:01:50 GMT The chat display projection only sanitized audio blocks with `entry.source.type === 'base64'` and string `source.data`, failing to strip top-level `data` fields, non-string `source.data`, or filesystem/local path references (e.g. `file://`, `~/`, `C:\\`, UNC paths) embedded in audio block fields like `path`, `file`, `url`, `openUrl`. Authenticated WebSocket and HTTP/SSE history clients could therefore retrieve raw audio bytes or host-local filesystem paths that were persisted in transcript blocks, leaking sensitive local file locations or raw audio payloads that should have been redacted at the shared history boundary. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/390 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/390 Sat, 08 Aug 2026 23:42:00 GMT The debug proxy capture cloned every response body and read it with no bound on inter-chunk wait time. A malicious or stalled remote server could send response headers plus a single chunk and then go silent indefinitely, leaving the clone() tee branch open forever; since a tee branch only settles when both branches cancel or reach EOF, this caused the caller's own cancellation and the subsequent transport release to hang, tying up connection/transport resources. The patch bounds the read with an idle timeout, cancelling the stalled branch and recording the exchange as 'stalled' metadata instead of blocking indefinitely. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/389 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/389 Sat, 08 Aug 2026 19:59:08 GMT normalizeActRequest recursively processed nested 'batch' actions without any depth limit, allowing a specially crafted POST /act request body (up to the 1MB limit) with tens of thousands of nested batch wrappers to cause unbounded recursion and crash the process with a RangeError (stack overflow) before validation checks could run. The patch introduces a depth parameter bound by ACT_MAX_BATCH_DEPTH, rejecting deeply nested payloads early with a clear error instead of overflowing the call stack. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/388 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/388 Sat, 08 Aug 2026 19:40:48 GMT The decodeMatrixEnvAccountToken function used Number.isFinite to validate hex-decoded code points before passing them to String.fromCodePoint, but Number.isFinite does not bound values to the valid Unicode range (0x0-0x10FFFF). A crafted environment variable name with a hex escape exceeding 0x10FFFF causes String.fromCodePoint to throw an uncaught RangeError, crashing listMatrixEnvAccountIds and preventing discovery of all Matrix accounts during startup/doctor checks. The patch adds an explicit upper-bound check (codePoint > 0x10ffff) to reject such tokens gracefully. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/387 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/387 Sat, 08 Aug 2026 04:44:06 GMT The voice-call provider clients (Twilio/Telnyx/Plivo) built error messages by directly embedding the raw provider HTTP error response body, which can echo back credential-bearing request details such as the Authorization header value, API keys, or account tokens. These unredacted error messages were thrown and could propagate into application logs or user-facing diagnostics, exposing secrets to anyone with access to logs or error output. The patch adds `redactSensitiveText` to strip credential-like content from the error snippet before it is used in thrown errors. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/382 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/382 Fri, 07 Aug 2026 11:28:24 GMT The sub-agent hard-deny list (blocking tools like sessions_send, message, conversations_*, gateway) could be overridden by configuring those tool names in an operator's allow/alsoAllow config, allowing a sub-agent session to regain direct message-sending and session-control capabilities that are supposed to be permanently restricted to enforce the announce-chain communication contract. Additionally, the message tool was only disabled at spawn time for hidden launches, so resumed or dashboard-visible sub-agent sessions could rebuild their tool set without that restriction and message users directly, bypassing the intended isolation boundary. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/383 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/383 Fri, 07 Aug 2026 11:28:40 GMT Gateway connection URLs can embed basic-auth credentials or token/API-key query parameters. Before this patch, several diagnostic surfaces (`openclaw status`, `status --all` text/JSON, and `logs` CLI error output) printed the raw connection URL verbatim, including embedded secrets, and probe failure text/thrown errors could also echo credential-bearing URLs. This exposes live credentials to terminal output, log files, or bug reports pasted by operators. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/380 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/380 Fri, 07 Aug 2026 00:31:25 GMT The Google Chat API client read error response bodies from remote/proxy servers and included the raw text verbatim in surfaced error messages without redaction. If a malicious or misconfigured upstream/proxy server reflected the request's Authorization header (bearer token) back in the error response body, that token would be exposed in error messages returned to users, logs, or downstream consumers. The fix applies forced redaction (redactToolPayloadText) to the error response text before it is used in any error message. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/376 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/376 Thu, 06 Aug 2026 09:48:15 GMT The plugin-node capability authorizer only checked whether a capability token existed and was unexpired, without checking if the owning client had already been invalidated (e.g., removed by an operator). This allowed a removed node's already-issued capability URL to continue authorizing Canvas HTTP requests during the window between invalidation and full connection teardown, since the invalidated client remained in the clients set and its capability entry was still matched. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/377 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/377 Thu, 06 Aug 2026 09:49:00 GMT Feishu's message-action contract did not declare its native camel-case/snake-case chat identifier fields (chatId, chat_id, channel_id) as delivery targets for the edit, pin, and unpin actions. Because the shared cross-context policy engine only inspects declared delivery-target aliases, operators using these native Feishu fields could bypass the configured 'disable within-provider cross-context messaging' restriction and perform message mutations against a chat/conversation different from the current context. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/374 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/374 Thu, 06 Aug 2026 04:27:38 GMT When a proxy or upstream server reflected the Discord bot's Authorization header value back in an error response (either HTML/text or JSON body), the raw bot token would be included unredacted in the error message surfaced to users/logs. This could expose the bot credential to anyone who could view logs, error output, or troubleshooting UI. The patch adds redaction of the token via redactToolPayloadText before formatting the final error text and before summarizing HTML bodies. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/369 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/369 Wed, 05 Aug 2026 04:28:35 GMT The stdout data handler for MCP stdio child processes called ReadBuffer.append synchronously without a try/catch. When a server (or attacker-influenced tool-result payload) produces a stdout frame exceeding the 10MiB ReadBuffer cap, append() throws synchronously inside the event callback, resulting in an unhandled exception that crashes the entire host process and terminates all concurrent sessions. The patch wraps the append/processReadBuffer calls in a try/catch that routes errors to onerror and gracefully closes the transport instead of crashing. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/360 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/360 Tue, 04 Aug 2026 15:06:14 GMT Shared group and channel chat sessions automatically loaded the workspace-root MEMORY.md file into the bootstrap context, exposing private long-term memory/context intended only for the main private session to all participants in a shared group or channel. Additionally, hooks could re-add or relabel the MEMORY.md file after initial filtering, bypassing session-type-based restrictions on private memory exposure. The patch enforces filtering of private memory files based on an authoritative chatType, re-applies the filter after hook mutations, and tracks file source identity to prevent relabeling/aliasing bypasses. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/361 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/361 Tue, 04 Aug 2026 15:07:45 GMT The DiscordRealtimeVoiceSession queued completed 'exact speech' messages without any bound on count or size while provider readiness, an active response, or playback prevented delivery. A stalled or misbehaving session could accumulate an unbounded backlog of speech text in memory, leading to unbounded memory growth and eventual resource exhaustion, and could later flush a large stale backlog. The patch introduces a fixed budget (32 messages / 32 KiB) and terminates the session on overflow, clearing state to prevent unbounded growth. medium verified