← All credits
侯海飞 (@feynman-hou)
8 vulnerability records and advisories credit this contributor.
CVE-2026-53830
OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload
CVE-2026-53824
Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay
CVE-2026-53858
OpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variable
CVE-2026-53846
OpenClaw < 2026.4.29 - Arbitrary Package Manager Execution via Workspace .env npm_execpath
CVE-2026-53842
OpenClaw < 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK_PYTHON Environment Variable
CVE-2026-53819
OpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override
CVE-2026-53813
OpenClaw < 2026.4.25 - Arbitrary Artifact Loading via Fake Package Root Resolution
CVE-2026-45005
OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation