https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:56:43 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-33572 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>`openclaw` created new session transcript JSONL files with overly broad default permissions in affected releases. On multi-user hosts, other local users or processes could read transcript contents, including secrets that might appear in tool output.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (`npm`) - Affected versions: `&lt;= 2026.2.15` - First fixed version: `2026.2.17` - Current latest npm release checked during verification: `2026.3.13` (not affected)</p> <p>## Impact</p> <p>Session transcript JSONL files are created under the local OpenClaw session store. In affected releases, newly created transcript files did not force user-only permissions, so transcript contents could be readable by other local users depending on the host environment and umask behavior.</p> <p>## Fix</p> <p>New transcript files are now created with `0o600` permissions. Existing transcript permission drift is also remediated by the security audit fix flow.</p> <p>Verified in code:</p> <p>- `src/config/sessions/transcript.ts:82` writes new transcript files with `mode: 0o600` - `src/config/sessions/sessions.test.ts:303` includes regression coverage asserting `0o600`</p> <p>## Fix Commit(s)</p> <p>- `095d522099653367e1b76fa5bb09d4ddf7c8a57c`</p> <p>## Release Note</p> <p>This fix first shipped in `2026.2.17` and is present in the current npm release `2026.3.13`.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>`openclaw` created new session transcript JSONL files with overly broad default permissions in affected releases. On multi-user hosts, other local users or processes could read transcript contents, including secrets that might appear in tool output.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (`npm`) - Affected versions: `&lt;= 2026.2.15` - First fixed version: `2026.2.17` - Current latest npm release checked during verification: `2026.3.13` (not affected)</p> <p>## Impact</p> <p>Session transcript JSONL files are created under the local OpenClaw session store. In affected releases, newly created transcript files did not force user-only permissions, so transcript contents could be readable by other local users depending on the host environment and umask behavior.</p> <p>## Fix</p> <p>New transcript files are now created with `0o600` permissions. Existing transcript permission drift is also remediated by the security audit fix flow.</p> <p>Verified in code:</p> <p>- `src/config/sessions/transcript.ts:82` writes new transcript files with `mode: 0o600` - `src/config/sessions/sessions.test.ts:303` includes regression coverage asserting `0o600`</p> <p>## Fix Commit(s)</p> <p>- `095d522099653367e1b76fa5bb09d4ddf7c8a57c`</p> <p>## Release Note</p> <p>This fix first shipped in `2026.2.17` and is present in the current npm release `2026.3.13`.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-33572 https://db.gcve.eu/vuln/cve-2026-33572 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.</p> https://db.gcve.eu/vuln/cve-2026-33572