Vulnerabilidades de la pila Node.js · Página 156

OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

### Summary When the optional Chrome extension relay is enabled, `/extension` accepted unauthenticated WebSocket upgrades while `/json/*` and `/cdp` required auth. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.17` - Latest published npm version at triage time: `2026.2.17` ### Impact This is a local-only issue on loopback (`127.0.0.1`) and only applies when the extension relay feature is in use. A local process on the same machine could connect to `/extension` without the token and interfere with extension-relay behavior. No remote network exploit path is involved. ### Fix - Require gateway-token a

• Actualiza a 2026.2.19

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

### Summary OpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.1.5` and `<= 2026.2.21-2` - Fixed on `main`: `9363c320d8ffe29290906752fab92621da02c3f7` - Planned patched release version (pre-set): `2026.2.22` ### Details The vulnerable chain was in the shell-env fallback path: 1. `src/infra/shell-env.ts` - `resolveShell(env)` trusted `env.SHELL` when set. - `execLoginShellEnvZero(...)` executed `${SHELL} -l -c "env -0"` with inherited runtime env. 2.

• Actualiza a 2026.2.22

OpenClaw plugin runtime command execution is part of trusted plugin boundary

### Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`). ### Impact Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version reviewed: `2026.2.17` - Affected range for this advisory record: `<= 2026.2.17` - Planned patched version metadata: `2026.2.19` (next release line) ### Fix Commit(s) - `2e

• Actualiza a 2026.2.19

OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption

### Summary In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload. ### Impact An attacker who obtained a valid `uploadId` within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path). ### Technical Details - Pending uploads stored `conversationId`, but invoke handling consumed by `uploadId` only. - The invoke path did not enforce conversation binding before `uploadToConsentUrl(...)` and pending-upload removal. - Fix binds

• Actualiza a 2026.2.25

OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

## Summary In authenticated non-owner DM sessions, a narrow tool-invocation path could reach broader-than-intended owner-only gateway actions. ## Impact This requires an authenticated non-owner sender in a DM session and a specific tool invocation path. No unauthenticated access is involved, and this does not provide direct code execution by itself. ## Root Cause - Some gateway call paths were still using broader default scopes instead of method-level least-privilege scopes. - Owner-only enforcement depended on tool-name checks and was not consistently metadata-driven across all call paths. ## Affected Packages / Versions - Package: `o

• Actualiza a 2026.2.19

OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

## Summary Remote iMessage attachment fetches used SCP with trust-on-first-use host-key behavior and accepted unvalidated remote host tokens. Before the fix: - SCP used `StrictHostKeyChecking=accept-new` in the remote attachment path. - `channels.imessage.remoteHost` was not validated as a strict SSH host token. ## Impact In remote iMessage deployments that use SCP attachment fetching, a first-connection MITM/DNS-poisoning scenario could cause the wrong host key to be trusted. Unsafe remote host token values could also alter SCP argument semantics. ## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm versio

• Actualiza a 2026.2.19

OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

### Summary Sandboxed `sessions_spawn(runtime="acp")` could bypass sandbox inheritance and initialize host-side ACP runtime. The fix now fail-closes ACP spawn from sandboxed requester sessions and rejects `sandbox="require"` for `runtime="acp"`. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version at triage time: `2026.3.1` (March 2, 2026) - Vulnerable range: `<=2026.3.1` - Patched release: `2026.3.2` (released) ### Technical Details - Root cause: `runtime="subagent"` enforced sandbox inheritance, while `runtime="acp"` did not enforce equivalent sandbox/runtime checks. - Security impact: sandbox-bounda

• Actualiza a 2026.3.2

OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

### Summary OpenClaw accepted `camera.snap` / `camera.clip` node payload `url` fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host. In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.13 <= 2026.3.1` - Latest vulnerable published version at time of update: `2026.3.1` - Patched versions: `>= 2026.3.2` (rele

• Actualiza a 2026.3.2

OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode

### Summary In `openclaw` allowlist mode, `tools.exec.safeBins` trusted PATH-derived directories for safe-bin resolution. A same-name binary placed in a trusted PATH directory could satisfy safe-bin checks and execute. ### Impact This is an allowlist bypass in exec policy that can lead to command execution in the OpenClaw runtime context when allowlist mode relies on safe bins and an attacker can influence trusted binary locations. ### Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable versions: `<= 2026.2.21-2` - Patched versions: `>= 2026.2.22` (planned next release) - Latest published npm version at triage time (2026-0

• Actualiza a 2026.2.22

PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection

A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. It is best practice to apply a patch to resolve this issue.

OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

## Impact In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be denied. ## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version currently affected: `2026.2.23` - Vulnerable range: `<= 2026.2.23` - Patched in planned next release: `2026.2.24` ## Fix Commit(s) - `9514201fb9b51de5d0b23151110d0ff5d9c8bd67` ## Technical Details The Telegram handler flow now enforces DM authorization before media download/write paths execu

• Actualiza a 2026.2.24

OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

### Summary In sandboxed runs, native prompt image auto-load did not honor `tools.fs.workspaceOnly=true`. This optional hardening setting is **not enabled by default**. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example `/agent/secret.png`) and load those image bytes for vision-capable model input. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version at triage time: `2026.2.23` - Vulnerable version range: `<= 2026.2.23` - Patched version (planned next release): `2026.2.24` ### Conditions Required This issue required all of the following: - sa

• Actualiza a 2026.2.24

OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection

A missing sender-authorization check in Telegram `message_reaction` handling allowed unauthorized users to trigger reaction-derived system events. ## Affected Packages / Versions - Package: `openclaw` (npm) - Introduced: `2026.2.17` - Affected: `>= 2026.2.17` and `<= 2026.2.24` - Latest published at patch time: `2026.2.24` - Patched in release: `2026.2.25` ## Impact When reaction notifications are enabled, unauthorized Telegram senders could inject reaction system events despite configured DM/group authorization controls (`dmPolicy`, `allowFrom`, `groupPolicy`, `groupAllowFrom`). ## Fix Commit(s) - `e56b0cf1a04f992ac6ebc775899f48ea31687

• Actualiza a 2026.2.25

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

• Actualiza a 2.5.9
• Actualiza a 3.3.2
• Actualiza a 3.3.2+dfsg-1

DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

• Actualiza a 3.2.7
• Actualiza a 3.3.2+dfsg-1

CVE-2026-3455

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

• Actualiza a 3.9.3

CVE-2026-3449

Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.

• Actualiza a 2.0.1
• Actualiza a 3.0.1

OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

## Vulnerability The hook authentication throttle keyed failed attempts by raw socket `remoteAddress` text. IPv4 and IPv4-mapped IPv6 forms of the same client (for example `1.2.3.4` and `::ffff:1.2.3.4`) were treated as different clients, allowing separate rate-limit buckets. ## Impact An attacker could split failed hook-auth attempts across both address forms and effectively double the brute-force budget from 20 to 40 attempts per 60-second window. ## Affected Components - `src/gateway/server-http.ts` - `src/gateway/auth-rate-limit.ts` ## Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable versions: `<= 2026.2.21-2`

• Actualiza a 2026.2.22

OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval

## Summary OpenClaw Gateway exposes an authenticated HTTP endpoint (`POST /tools/invoke`) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments: - The HTTP gateway layer did not deny high-risk session orchestration tools by default, allowing a caller with Gateway auth to invoke tools like `sessions_spawn` / `sessions_send` and pivot into creating or controlling agent sessions. - ACP clients could auto-approve permission requests for risky tools with insufficient user interaction/guardrails, reducing the friction that should normally prevent s

• Actualiza a 2026.2.14

OpenClaw: Node exec approvals could be replayed across nodes

## Summary `exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet. ## Impact An operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.22-2` - Fixed: `2026.2.23` (released) ## Mitigation Upgrade to `2026.2.23` or later once published. ## Fix Details The fix requires and persists `nodeId` for

• Actualiza a 2026.2.23