https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 09:12:47 +0000 https://cve.radiocsirt.org/vuln/cve-2026-26320 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked &#34;Run.&#34; At the time of writing, the OpenClaw macOS desktop client is still in beta. In versions 2026.2.6 through 2026.2.13, an attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed. If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user&#39;s configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message. The issue is fixed in 2026.2.14. Other mitigations include not approve unexpected &#34;Run OpenClaw agent?&#34; prompts triggered while browsing untrusted sites and usingunattended deep links only with a valid `key` for trusted personal automations.</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked &#34;Run.&#34; At the time of writing, the OpenClaw macOS desktop client is still in beta. In versions 2026.2.6 through 2026.2.13, an attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed. If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user&#39;s configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message. The issue is fixed in 2026.2.14. Other mitigations include not approve unexpected &#34;Run OpenClaw agent?&#34; prompts triggered while browsing untrusted sites and usingunattended deep links only with a valid `key` for trusted personal automations.</p> https://cve.radiocsirt.org/vuln/cve-2026-26320 https://cve.radiocsirt.org/vuln/ghsa-7q2j-c4q5-rm27 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked &#34;Run&#34;.</p> <p>At the time of writing, the OpenClaw macOS desktop client is still in beta.</p> <p>An attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed.</p> <p>### Impact If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user&#39;s configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message.</p> <p>## Affected Versions - OpenClaw macOS desktop client versions &gt;= 2026.2.6 and &lt;= 2026.2.13.</p> <p>## Fixed Versions - 2026.2.14.</p> <p>### Mitigations - Do not approve unexpected &#34;Run OpenClaw agent?&#34; prompts triggered while browsing untrusted sites. - Use unattended deep links only with a valid `key` for trusted personal automations.</p> <p>### Resolution Unkeyed deep links now enforce a strict message length limit for confirmation and ignore delivery/routing knobs (`deliver`, `to`, `channel`) unless a valid unattended `key` is provided.</p> <p>Fix commit: 28d9dd7a772501ccc3f71457b4adfee79084fe6f</p> <p>---</p> <p>Fix c…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked &#34;Run&#34;.</p> <p>At the time of writing, the OpenClaw macOS desktop client is still in beta.</p> <p>An attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed.</p> <p>### Impact If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user&#39;s configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message.</p> <p>## Affected Versions - OpenClaw macOS desktop client versions &gt;= 2026.2.6 and &lt;= 2026.2.13.</p> <p>## Fixed Versions - 2026.2.14.</p> <p>### Mitigations - Do not approve unexpected &#34;Run OpenClaw agent?&#34; prompts triggered while browsing untrusted sites. - Use unattended deep links only with a valid `key` for trusted personal automations.</p> <p>### Resolution Unkeyed deep links now enforce a strict message length limit for confirmation and ignore delivery/routing knobs (`deliver`, `to`, `channel`) unless a valid unattended `key` is provided.</p> <p>Fix commit: 28d9dd7a772501ccc3f71457b4adfee79084fe6f</p> <p>---</p> <p>Fix c…</p> https://cve.radiocsirt.org/vuln/ghsa-7q2j-c4q5-rm27