https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:08:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-35637 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.</p> https://cve.radiocsirt.org/vuln/cve-2026-35637 https://cve.radiocsirt.org/vuln/ghsa-vfg3-pqpq-93m4 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Tlon cite expansion happened before channel and DM authorization completed, allowing cite work and content handling before the final auth decision.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: &lt; 2026.3.22 - Fixed: &gt;= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`</p> <p>## Fix Commit(s) - `3cbf932413e41d1836cb91aed1541a28a3122f93` - `ebee4e2210e1f282a982c7ef2ad79d77a572fc87`</p> <p>## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.</p> <p>## Code-Level Confirmation - extensions/tlon/src/monitor/index.ts now defers cite expansion until after authorization and preserves explicit empty-allowlist semantics. - extensions/tlon/src/monitor/utils.ts and extensions/tlon/src/security.test.ts ship the deferred cite expansion behavior and regressions.</p> <p>OpenClaw thanks @zpbrent for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Tlon cite expansion happened before channel and DM authorization completed, allowing cite work and content handling before the final auth decision.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: &lt; 2026.3.22 - Fixed: &gt;= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`</p> <p>## Fix Commit(s) - `3cbf932413e41d1836cb91aed1541a28a3122f93` - `ebee4e2210e1f282a982c7ef2ad79d77a572fc87`</p> <p>## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.</p> <p>## Code-Level Confirmation - extensions/tlon/src/monitor/index.ts now defers cite expansion until after authorization and preserves explicit empty-allowlist semantics. - extensions/tlon/src/monitor/utils.ts and extensions/tlon/src/security.test.ts ship the deferred cite expansion behavior and regressions.</p> <p>OpenClaw thanks @zpbrent for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-vfg3-pqpq-93m4