https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:51:26.140319+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-43532 BREW-openclaw-cli-CVE-2026-43532 — OpenClaw: Discord event cover images bypassed sandbox media normalization 2026-10-05T18:51:26.205109+00:00

Affected: Homebrew: openclaw-cli

## Summary

Discord event cover images bypassed sandbox media normalization.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.7 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Discord event cover image parameters could bypass the sandbox media normalization path used for outbound local media, allowing host-local media references to reach a channel action path that expected normalized media.

## Technical Details

The fix includes Discord `eventCreate.image` in sandbox media normalization and adds coverage for the event-create media path.

## Fix

The issue was fixed in #64377. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `979c6f09d6fad96596feb91c905934be7e0b4f15` - PR: #64377

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308524 EUVD-2026-308524 2026-10-05T18:51:26.205186+00:00 EUVD-2026-308524 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43532 fkie_cve-2026-43532 2026-10-05T18:51:26.205202+00:00

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media.

 https://cve.radiocsirt.org/vuln/ghsa-c9h3-5p7r-mrjh GHSA-c9h3-5p7r-mrjh — OpenClaw: Discord event cover images bypassed sandbox media normalization 2026-10-05T18:51:26.205226+00:00

Affected: npm: openclaw

## Summary

Discord event cover images bypassed sandbox media normalization.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.7 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Discord event cover image parameters could bypass the sandbox media normalization path used for outbound local media, allowing host-local media references to reach a channel action path that expected normalized media.

## Technical Details

The fix includes Discord `eventCreate.image` in sandbox media normalization and adds coverage for the event-create media path.

## Fix

The issue was fixed in #64377. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `979c6f09d6fad96596feb91c905934be7e0b4f15` - PR: #64377

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-05T18:51:26.205261+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.