https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:22:05.692377+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41383 BREW-openclaw-cli-CVE-2026-41383 — OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped 2026-10-03T10:22:05.696106+00:00

Affected: Homebrew: openclaw-cli

## Summary

Before OpenClaw 2026.4.2, the OpenShell mirror backend accepted arbitrary absolute `remoteWorkspaceDir` and `remoteAgentWorkspaceDir` values. In mirror mode, those paths were then used as the target of remote cleanup and overwrite operations.

## Impact

If an attacker could influence those OpenShell config values, mirror sync could delete the contents of an unintended remote directory and replace them with uploaded workspace data. This was a destructive remote-path bug in the mirror-sync path.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected versions: `<= 2026.4.1` - Patched versions: `>= 2026.4.2` - Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `b21c9840c2e38f4bb338d031511b479d5f07ca25` — constrain OpenShell mirror sync roots

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @jufeng123768 for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-307982 EUVD-2026-307982 2026-10-03T10:22:05.696180+00:00 EUVD-2026-307982 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41383 fkie_cve-2026-41383 2026-10-03T10:22:05.696197+00:00

OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data.

 https://cve.radiocsirt.org/vuln/ghsa-m34q-h93w-vg5x GHSA-m34q-h93w-vg5x — OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped 2026-10-03T10:22:05.696221+00:00

Affected: npm: openclaw

## Summary

Before OpenClaw 2026.4.2, the OpenShell mirror backend accepted arbitrary absolute `remoteWorkspaceDir` and `remoteAgentWorkspaceDir` values. In mirror mode, those paths were then used as the target of remote cleanup and overwrite operations.

## Impact

If an attacker could influence those OpenShell config values, mirror sync could delete the contents of an unintended remote directory and replace them with uploaded workspace data. This was a destructive remote-path bug in the mirror-sync path.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected versions: `<= 2026.4.1` - Patched versions: `>= 2026.4.2` - Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `b21c9840c2e38f4bb338d031511b479d5f07ca25` — constrain OpenShell mirror sync roots

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @jufeng123768 for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0980 WID-SEC-W-2026-0980 — OpenClaw: Mehrere Schwachstellen 2026-10-03T10:22:05.696255+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Daten zu manipulieren, Sicherheitsmechanismen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen..