https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 21:58:02 +0000 https://cve.radiocsirt.org/vuln/ghsa-w5c7-9qqw-6645 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Inter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: &#34;user&#34;` without provenance metadata.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.12` (i.e. `&lt; 2026.2.13`) - Fixed in: `2026.2.13` (patched versions `&gt;= 2026.2.13`)</p> <p>## Impact</p> <p>A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.</p> <p>This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust `role: &#34;user&#34;` as a sole authority signal.</p> <p>## Technical details</p> <p>Before the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.</p> <p>As a result, downstream workers and transcript readers could not distinguish: - External user input - Internal inter-session routed input</p> <p>## Fix</p> <p>OpenClaw now carries explicit input provenance end-to-end for routed prompts.</p> <p>Key changes: - Added structured provenance model (`inputProvenance`) with `kind` values including `inter_session`. - `sessions_send` and agent-to-agent steps now set inter-session provenance when invoking target runs. - Provenance is persisted on user messages as `message.provenance.kind = &#34;inter_session&#34;` (role remains `user` for provider compatibility). - Transcript readers and memory helpers were updated to respect pr…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Inter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: &#34;user&#34;` without provenance metadata.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.12` (i.e. `&lt; 2026.2.13`) - Fixed in: `2026.2.13` (patched versions `&gt;= 2026.2.13`)</p> <p>## Impact</p> <p>A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.</p> <p>This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust `role: &#34;user&#34;` as a sole authority signal.</p> <p>## Technical details</p> <p>Before the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.</p> <p>As a result, downstream workers and transcript readers could not distinguish: - External user input - Internal inter-session routed input</p> <p>## Fix</p> <p>OpenClaw now carries explicit input provenance end-to-end for routed prompts.</p> <p>Key changes: - Added structured provenance model (`inputProvenance`) with `kind` values including `inter_session`. - `sessions_send` and agent-to-agent steps now set inter-session provenance when invoking target runs. - Provenance is persisted on user messages as `message.provenance.kind = &#34;inter_session&#34;` (role remains `user` for provider compatibility). - Transcript readers and memory helpers were updated to respect pr…</p> https://cve.radiocsirt.org/vuln/ghsa-w5c7-9qqw-6645