https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 09:52:52 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41366 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary Media Local Roots Self-Whitelisting in `appendLocalMediaParentRoots` Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `1ca4261d7e055d0be141ed79ebb1365d0fbc7364` — 2026-03-30T17:15:03+01:00</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary Media Local Roots Self-Whitelisting in `appendLocalMediaParentRoots` Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `1ca4261d7e055d0be141ed79ebb1365d0fbc7364` — 2026-03-30T17:15:03+01:00</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41366 https://cve.radiocsirt.org/vuln/cnvd-2026-19030 cnvd-2026-19030 https://cve.radiocsirt.org/vuln/cnvd-2026-19030 https://cve.radiocsirt.org/vuln/euvd-2026-293326 EUVD-2026-293326 https://cve.radiocsirt.org/vuln/euvd-2026-293326 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41366 <p>OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.</p> <p>OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41366 https://cve.radiocsirt.org/vuln/ghsa-ppvx-q97v-2m28 <p>OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.</p> <p>OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.</p> https://cve.radiocsirt.org/vuln/ghsa-ppvx-q97v-2m28 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 <p>Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948