Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OpenClaw 2026.2.23 Clear all filters
TI-2026-24581 CVE-2026-32040 · GHSA-2ww6-868g-2c56

OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation

Priority LOW 12

OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content bloc…

CVSS 4.0LOW 2.4 Local Low privileges User interaction EPSS 0.00157 Published 2026-03-19 Fixed in 2026.2.23 CWE-79
TI-2026-24549 CVE-2026-32007 · GHSA-h9xm-j4qg-fvpg

OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass

Priority LOW 35

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inc…

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00387 Published 2026-03-19 Fixed in 2026.2.23 CWE-22
TI-2026-24544 CVE-2026-32002 · GHSA-q6qf-4p5j-r25g

OpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass

Priority LOW 27

OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictions on mounted sandbox paths, allowing attackers to read out-o…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00335 Published 2026-03-19 Fixed in 2026.2.23 CWE-200
TI-2026-24534 CVE-2026-31992 · GHSA-48wf-g7cp-gr3m

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

Priority LOW 31

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00352 Published 2026-03-19 Fixed in 2026.2.23 CWE-184