https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 17:57:02 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-ghsa-f6h3-846h-2r8w <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary In certain elevated-mode configurations, `tools.elevated.allowFrom` accepted broader identity signals than intended. The fix tightens matching to sender-scoped identity by default and makes mutable metadata matching explicit.</p> <p>### Context OpenClaw is commonly used in 1:1 chats or trusted group chats. In that intended model, this issue is best treated as authorization hardening / defense-in-depth for elevated sender approval.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version at triage: `2026.2.21-2` - Affected versions: `&lt;= 2026.2.21-2` - Planned patched version (pre-set for publish-ready advisory): `2026.2.22`</p> <p>### Details Elevated sender authorization now matches sender-scoped identity values only by default (`SenderId`, `From`, `SenderE164`) and no longer considers recipient routing fields such as `ctx.To`.</p> <p>Mutable sender metadata (`SenderName`, `SenderUsername`, `SenderTag`) now requires explicit allowlist prefixes (`name:`, `username:`, `tag:`). Explicit identity prefixes are also supported (`id:`, `from:`, `e164:`).</p> <p>### Fix Commit(s) - `6817c0ec7b4fa830123d4f5c340f075a4bd04ee2`</p> <p>### Release Process Note The advisory `patched_versions` is pre-set to the planned next release (`2026.2.22`). Once npm `openclaw@2026.2.22` is published, this advisory can be published without additional content edits.</p> <p>OpenClaw thanks @jiseoung for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary In certain elevated-mode configurations, `tools.elevated.allowFrom` accepted broader identity signals than intended. The fix tightens matching to sender-scoped identity by default and makes mutable metadata matching explicit.</p> <p>### Context OpenClaw is commonly used in 1:1 chats or trusted group chats. In that intended model, this issue is best treated as authorization hardening / defense-in-depth for elevated sender approval.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version at triage: `2026.2.21-2` - Affected versions: `&lt;= 2026.2.21-2` - Planned patched version (pre-set for publish-ready advisory): `2026.2.22`</p> <p>### Details Elevated sender authorization now matches sender-scoped identity values only by default (`SenderId`, `From`, `SenderE164`) and no longer considers recipient routing fields such as `ctx.To`.</p> <p>Mutable sender metadata (`SenderName`, `SenderUsername`, `SenderTag`) now requires explicit allowlist prefixes (`name:`, `username:`, `tag:`). Explicit identity prefixes are also supported (`id:`, `from:`, `e164:`).</p> <p>### Fix Commit(s) - `6817c0ec7b4fa830123d4f5c340f075a4bd04ee2`</p> <p>### Release Process Note The advisory `patched_versions` is pre-set to the planned next release (`2026.2.22`). Once npm `openclaw@2026.2.22` is published, this advisory can be published without additional content edits.</p> <p>OpenClaw thanks @jiseoung for reporting.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-ghsa-f6h3-846h-2r8w