https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 08:30:43 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-ghsa-j26j-7qc4-3mrf <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload.</p> <p>### Impact An attacker who obtained a valid `uploadId` within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path).</p> <p>### Technical Details - Pending uploads stored `conversationId`, but invoke handling consumed by `uploadId` only. - The invoke path did not enforce conversation binding before `uploadToConsentUrl(...)` and pending-upload removal. - Fix binds accept/decline handling to normalized conversation id match before consuming pending upload state.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version (as of February 26, 2026): `2026.2.24` - Vulnerable range: `&lt;= 2026.2.24` - Patched in release: `2026.2.25`</p> <p>### Remediation Upgrade to `openclaw` `2026.2.25` (or later) once published.</p> <p>### Fix Commit(s) - `347f7b9550064f5f5b33c6e07f64e85b9657b6f1`</p> <p>### Release Process Note `patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload.</p> <p>### Impact An attacker who obtained a valid `uploadId` within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path).</p> <p>### Technical Details - Pending uploads stored `conversationId`, but invoke handling consumed by `uploadId` only. - The invoke path did not enforce conversation binding before `uploadToConsentUrl(...)` and pending-upload removal. - Fix binds accept/decline handling to normalized conversation id match before consuming pending upload state.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version (as of February 26, 2026): `2026.2.24` - Vulnerable range: `&lt;= 2026.2.24` - Patched in release: `2026.2.25`</p> <p>### Remediation Upgrade to `openclaw` `2026.2.25` (or later) once published.</p> <p>### Fix Commit(s) - `347f7b9550064f5f5b33c6e07f64e85b9657b6f1`</p> <p>### Release Process Note `patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-ghsa-j26j-7qc4-3mrf