https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:59:27.899422+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-35651 BREW-openclaw-cli-CVE-2026-35651 — OpenClaw has ACP CLI approval prompt ANSI escape sequence injection 2026-10-03T10:59:27.961535+00:00

Affected: Homebrew: openclaw-cli

## Summary

ACP CLI approval prompt ANSI escape sequence injection

## Affected Packages / Versions

- Package: `openclaw` - Affected versions: `>= 2026.2.13, <= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24`

## Details

ACP tool titles could previously carry ANSI control sequences into approval prompts and permission logs, letting untrusted tool metadata spoof terminal output. Commit `464e2c10a5edceb380d815adb6ff56e1a4c50f60` sanitizes tool titles at the source and broadens ANSI stripping to full CSI sequences.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `464e2c10a5edceb380d815adb6ff56e1a4c50f60`.

## Fix Commit(s)

- `464e2c10a5edceb380d815adb6ff56e1a4c50f60`

 https://cve.radiocsirt.org/vuln/euvd-2026-329528 EUVD-2026-329528 2026-10-03T10:59:27.961598+00:00 EUVD-2026-329528 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35651 fkie_cve-2026-35651 2026-10-03T10:59:27.961614+00:00

OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof terminal output. Untrusted tool metadata can carry ANSI control sequences into approval prompts and permission logs, enabling attackers to manipulate displayed information through malicious tool titles.

 https://cve.radiocsirt.org/vuln/ghsa-4hmj-39m8-jwc7 GHSA-4hmj-39m8-jwc7 — OpenClaw has ACP CLI approval prompt ANSI escape sequence injection 2026-10-03T10:59:27.961637+00:00

Affected: npm: openclaw

## Summary

ACP CLI approval prompt ANSI escape sequence injection

## Affected Packages / Versions

- Package: `openclaw` - Affected versions: `>= 2026.2.13, <= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24`

## Details

ACP tool titles could previously carry ANSI control sequences into approval prompts and permission logs, letting untrusted tool metadata spoof terminal output. Commit `464e2c10a5edceb380d815adb6ff56e1a4c50f60` sanitizes tool titles at the source and broadens ANSI stripping to full CSI sequences.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `464e2c10a5edceb380d815adb6ff56e1a4c50f60`.

## Fix Commit(s)

- `464e2c10a5edceb380d815adb6ff56e1a4c50f60`

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0884 WID-SEC-W-2026-0884 — OpenClaw: Mehrere Schwachstellen 2026-10-03T10:59:27.961666+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte, einschließlich Administratorrechte, zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.