https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 06:17:32 +0000 https://cve.radiocsirt.org/vuln/ghsa-4cqv-h74h-93j4 <p><strong>Affected:</strong> npm: openclaw</p> <p>OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.21-2` - Patched versions: &gt;= 2026.2.22</p> <p>## What Changed - `openclaw security audit` now warns on Discord name/tag allowlist entries (DM allowlists, guild/channel `users`, and pairing-store entries). - Runtime authorization now prefers resolved user IDs when a configured name/tag can be resolved, without rewriting config files on disk. - Name-based entries remain supported for compatibility.</p> <p>## Recommendations - Prefer stable Discord user IDs for security-sensitive allowlists. - Run `openclaw security audit` and address warnings where practical.</p> <p>## Fix Commit(s) - f97c45c5b5e0698b6667bb5f6badc0cac7dabd12 - 747bb581b3f2264495e1fec5a0727d9f2ca1b6f1</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.21-2` - Patched versions: &gt;= 2026.2.22</p> <p>## What Changed - `openclaw security audit` now warns on Discord name/tag allowlist entries (DM allowlists, guild/channel `users`, and pairing-store entries). - Runtime authorization now prefers resolved user IDs when a configured name/tag can be resolved, without rewriting config files on disk. - Name-based entries remain supported for compatibility.</p> <p>## Recommendations - Prefer stable Discord user IDs for security-sensitive allowlists. - Run `openclaw security audit` and address warnings where practical.</p> <p>## Fix Commit(s) - f97c45c5b5e0698b6667bb5f6badc0cac7dabd12 - 747bb581b3f2264495e1fec5a0727d9f2ca1b6f1</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-4cqv-h74h-93j4