Live › vulnerability › GHSA-jw7v-5mp7-ghgm
Go to dashboardThis advisory is withdrawn as a duplicate of GHSA-3x84-qq85-fj65, which covers the same flaw. The original text says OpenClaw before 2026.6.6 let browser CDP discovery accept WebSocket URLs that policy should block, letting lower-trust users reach blocked network destinations when the browser feature is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| openclaw | npm | < 2026.6.6 | 2026.6.6 |
Unknown from the sources.
Upgrade openclaw to 2026.6.6 or later, tracked under GHSA-3x84-qq85-fj65.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-3x84-qq85-fj65. This link is maintained to preserve external references.
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.
This page as .md · .json · in your agent: get_signal("GHSA-jw7v-5mp7-ghgm")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.