每日自动更新

🛡️ UCloud OpenClaw CVEs

安全漏洞追踪面板 — 基于 cvelistV5 + GitHub Advisory Database 数据

59
已发布 CVE
212
安全公告
110
HIGH / CRITICAL
59/59
Pipeline 全部已发布
📋 CVE 列表 🔄 发布流水线 📢 安全公告 📊 漏洞分类 💡 关键洞察

📋 已发布 CVE（cvelistV5）

60
CVE ID严重性CVSS漏洞描述发布日期
CVE-2026-24763 🔴 HIGH 8.8 OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable 2026-02-02
CVE-2026-25253 🔴 HIGH 8.8 OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl 2026-02-01
CVE-2026-28478 🔴 HIGH 8.7 OpenClaw affected by denial of service via unbounded webhook request body buffering 2026-03-05
CVE-2026-53814 🔴 HIGH 8.7 OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority 2026-06-11
CVE-2026-53817 🔴 HIGH 8.7 OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing 2026-06-11
CVE-2026-53836 🔴 HIGH 8.7 OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases 2026-06-12
CVE-2026-53843 🔴 HIGH 8.7 OpenClaw: Pairing-scoped device session could restore revoked node token authority 2026-06-16
CVE-2026-53819 🔴 HIGH 8.7 OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows 2026-06-11
CVE-2026-53816 🔴 HIGH 8.6 OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node 2026-06-11
CVE-2026-53857 🔴 HIGH 8.6 OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy 2026-06-16
CVE-2026-53849 🔴 HIGH 8.6 OpenClaw: Discord allowFrom could bind to mutable display names 2026-06-16
CVE-2026-28469 🔴 HIGH 8.2 OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting 2026-03-05
CVE-2026-53834 🔴 HIGH 8.2 OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands 2026-06-12
CVE-2026-35630 🔴 HIGH 8 OpenClaw: QQBot native approval buttons did not enforce configured approver identity 2026-05-29
CVE-2026-25157 🔴 HIGH 7.8 OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand 2026-02-04
CVE-2026-53806 🔴 HIGH 7.7 OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation 2026-06-11
CVE-2026-53810 🔴 HIGH 7.7 OpenClaw's marketplace runtime extension metadata could point at unscanned payloads 2026-06-11
CVE-2026-53811 🔴 HIGH 7.7 OpenClaw: Matrix allowFrom could bind to mutable display names 2026-06-11
CVE-2026-53831 🔴 HIGH 7.6 OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion 2026-06-12
CVE-2026-53853 🔴 HIGH 7.6 OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns 2026-06-16
CVE-2026-53855 🔴 HIGH 7.6 OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks 2026-06-16
CVE-2026-53864 🔴 HIGH 7.6 OpenClaw: Host environment sanitizer missed two Node.js control variables 2026-06-16
CVE-2026-53866 🔴 HIGH 7.6 OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing 2026-06-16
CVE-2026-28458 🔴 HIGH 7.4 OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access 2026-03-05
CVE-2026-53832 🔴 HIGH 7.4 OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration 2026-06-12
CVE-2026-53833 🔴 HIGH 7.4 OpenClaw: QQBot streaming command could mutate config without explicit allowFrom 2026-06-12
CVE-2026-53813 🔴 HIGH 7.3 OpenClaw: Fake package roots could influence memory-core artifact loading 2026-06-11
CVE-2026-53865 🔴 HIGH 7.2 OpenClaw: Workspace-derived service PATH could influence trash command selection 2026-06-16
CVE-2026-26317 🔴 HIGH 7.1 OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints 2026-02-19
CVE-2026-53815 🔴 HIGH 7.1 OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions 2026-06-11
CVE-2026-43531 🔴 HIGH 7 OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File 2026-05-05
CVE-2026-53842 🔴 HIGH 7 OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution 2026-06-16
CVE-2026-53846 🔴 HIGH 7 OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install 2026-06-16
CVE-2026-53858 🔴 HIGH 7 OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots 2026-06-16
CVE-2026-28480 🟡 MEDIUM 6.9 OpenClaw Telegram allowlist authorization accepted mutable usernames 2026-03-05
CVE-2026-53818 🟡 MEDIUM 6.9 OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback 2026-06-11
CVE-2026-29612 🟡 MEDIUM 6.8 OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding 2026-03-05
CVE-2026-53850 🟡 MEDIUM 6.8 OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command 2026-06-16
CVE-2026-28452 🟡 MEDIUM 6.7 OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) 2026-03-05
CVE-2026-26328 🟡 MEDIUM 6.5 OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities 2026-02-19
CVE-2026-53837 🟡 MEDIUM 6.3 OpenClaw: Mattermost handlers could fall open when channel type was missing 2026-06-12
CVE-2026-53851 🟡 MEDIUM 6.3 OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass 2026-06-16
CVE-2026-53830 🟡 MEDIUM 6 OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload 2026-06-12
CVE-2026-53838 🟡 MEDIUM 6 OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection 2026-06-12
CVE-2026-53840 🟡 MEDIUM 6 OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin 2026-06-16
CVE-2026-53844 🟡 MEDIUM 6 OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search 2026-06-16
CVE-2026-53854 🟡 MEDIUM 6 OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state 2026-06-16
CVE-2026-53863 🟡 MEDIUM 6 OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy 2026-06-16
CVE-2026-53859 🟡 MEDIUM 6 OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency 2026-06-16
CVE-2026-53856 🟡 MEDIUM 5.7 OpenClaw: Config recovery could restore openclaw.json with broad file permissions 2026-06-16
CVE-2026-53847 🟡 MEDIUM 5.3 OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope 2026-06-16
CVE-2026-53861 🟡 MEDIUM 5.3 OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS 2026-06-16
CVE-2026-53812 🟡 MEDIUM 4.9 OpenClaw's browser act interactions could bypass private-network navigation checks 2026-06-11
CVE-2026-53809 🟡 MEDIUM 4.8 OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy 2026-06-11
CVE-2026-53845 🟢 LOW 2.3 OpenClaw: Skill-command dispatch could skip before-tool-call hooks 2026-06-16
CVE-2026-53852 🟢 LOW 2.3 OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing 2026-06-16
CVE-2026-53860 🟢 LOW 2.3 OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers 2026-06-16
CVE-2026-53848 🟢 LOW 2.3 OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers 2026-06-16
CVE-2026-53862 🟢 LOW 2.3 OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening 2026-06-16
CVE-2026-53841 🟢 LOW 2.1 OpenClaw: Exported session HTML could keep unsafe markdown links 2026-06-16

🔄 CVE 发布流水线

59/59 已发布
CVE ID状态CNAGHSA 发布日期cvelistV5
CVE-2026-24763 ✅ PUBLISHED GitHub_M 2026-02-02 ✅ 已收录
CVE-2026-25157 ✅ PUBLISHED GitHub_M 2026-02-02 ✅ 已收录
CVE-2026-25253 ✅ PUBLISHED mitre 2026-02-02 ✅ 已收录
CVE-2026-26317 ✅ PUBLISHED GitHub_M 2026-02-18 ✅ 已收录
CVE-2026-26328 ✅ PUBLISHED GitHub_M 2026-02-18 ✅ 已收录
CVE-2026-28452 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-28458 ✅ PUBLISHED VulnCheck 2026-02-17 ✅ 已收录
CVE-2026-28469 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-28478 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-28480 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-29612 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-35630 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53806 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53809 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53810 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53811 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53812 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53813 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53814 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53815 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53816 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53817 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53818 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53819 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53830 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53831 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53832 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53833 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53834 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53836 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53837 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53838 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53840 ✅ PUBLISHED VulnCheck 2026-06-17 ✅ 已收录
CVE-2026-53841 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53842 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53843 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53844 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53845 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53846 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53847 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53848 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53849 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53850 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53851 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53852 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53853 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53854 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53855 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53856 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53857 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53858 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53859 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53860 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53861 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53862 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53863 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53864 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53865 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53866 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53836 ✅ PUBLISHED | [GHSA-7hxm-f538-3xp6](https://github.com/advisories/GHSA-7hxm-f538-3xp6) 2026-07-02 ✅ 已收录
CVE-2026-53816 ✅ PUBLISHED | [GHSA-vxx3-6hc9-7cc3](https://github.com/advisories/GHSA-vxx3-6hc9-7cc3) 2026-07-02 ✅ 已收录
CVE-2026-53813 ✅ PUBLISHED | [GHSA-8wg3-5mcm-fjq8](https://github.com/advisories/GHSA-8wg3-5mcm-fjq8) 2026-07-02 ✅ 已收录
CVE-2026-53834 ✅ PUBLISHED | [GHSA-jvm4-4j77-39p6](https://github.com/advisories/GHSA-jvm4-4j77-39p6) 2026-07-02 ✅ 已收录
CVE-2026-53831 ✅ PUBLISHED | [GHSA-mgq6-vr84-7m2j](https://github.com/advisories/GHSA-mgq6-vr84-7m2j) 2026-07-02 ✅ 已收录
CVE-2026-53814 ✅ PUBLISHED | [GHSA-chr9-m4q2-76hw](https://github.com/advisories/GHSA-chr9-m4q2-76hw) 2026-07-02 ✅ 已收录
CVE-2026-53832 ✅ PUBLISHED | [GHSA-v6r2-jh58-xx6w](https://github.com/advisories/GHSA-v6r2-jh58-xx6w) 2026-07-02 ✅ 已收录
CVE-2026-53815 ✅ PUBLISHED | [GHSA-p73f-w79w-jqr5](https://github.com/advisories/GHSA-p73f-w79w-jqr5) 2026-07-02 ✅ 已收录
CVE-2026-53865 ✅ PUBLISHED | [GHSA-wc84-j36w-pw4x](https://github.com/advisories/GHSA-wc84-j36w-pw4x) 2026-06-18 ✅ 已收录
CVE-2026-53849 ✅ PUBLISHED | [GHSA-24vr-rprv-67rf](https://github.com/advisories/GHSA-24vr-rprv-67rf) 2026-06-18 ✅ 已收录
CVE-2026-53853 ✅ PUBLISHED | [GHSA-8c59-hr4w-qg69](https://github.com/advisories/GHSA-8c59-hr4w-qg69) 2026-06-18 ✅ 已收录
CVE-2026-53855 ✅ PUBLISHED | [GHSA-fq9j-vw4w-fr6v](https://github.com/advisories/GHSA-fq9j-vw4w-fr6v) 2026-06-18 ✅ 已收录
CVE-2026-53866 ✅ PUBLISHED | [GHSA-q99w-vh6v-q3v7](https://github.com/advisories/GHSA-q99w-vh6v-q3v7) 2026-06-18 ✅ 已收录
CVE-2026-53864 ✅ PUBLISHED | [GHSA-rjxq-qqhf-8hwh](https://github.com/advisories/GHSA-rjxq-qqhf-8hwh) 2026-06-18 ✅ 已收录
CVE-2026-28469 ✅ PUBLISHED | [GHSA-3fqr-4cg8-h96q](https://github.com/advisories/GHSA-3fqr-4cg8-h96q) 2026-02-18 ✅ 已收录
CVE-2026-28478 ✅ PUBLISHED | [GHSA-mr32-vwc2-5j6h](https://github.com/advisories/GHSA-mr32-vwc2-5j6h) 2026-02-18 ✅ 已收录
CVE-2026-25157 ✅ PUBLISHED | [GHSA-g8p2-7wf7-98mq](https://github.com/advisories/GHSA-g8p2-7wf7-98mq) 2026-02-02 ✅ 已收录
CVE-2026-24763 ✅ PUBLISHED | [GHSA-r2c6-8jc8-g32w](https://github.com/advisories/GHSA-r2c6-8jc8-g32w) 2026-02-02 ✅ 已收录
CVE-2026-53818 ✅ PUBLISHED | [GHSA-275c-xpvc-jgfw](https://github.com/advisories/GHSA-275c-xpvc-jgfw) 2026-07-02 ✅ 已收录
CVE-2026-53809 ✅ PUBLISHED | [GHSA-gp79-m99v-gjmh](https://github.com/advisories/GHSA-gp79-m99v-gjmh) 2026-07-02 ✅ 已收录
CVE-2026-53838 ✅ PUBLISHED | [GHSA-2hfg-4fh4-qp7f](https://github.com/advisories/GHSA-2hfg-4fh4-qp7f) 2026-07-02 ✅ 已收录
CVE-2026-53854 ✅ PUBLISHED | [GHSA-mpc8-jxjh-qpgh](https://github.com/advisories/GHSA-mpc8-jxjh-qpgh) 2026-06-18 ✅ 已收录
CVE-2026-53844 ✅ PUBLISHED | [GHSA-rwp6-7w3q-75fq](https://github.com/advisories/GHSA-rwp6-7w3q-75fq) 2026-06-18 ✅ 已收录
CVE-2026-53847 ✅ PUBLISHED | [GHSA-w9hf-3pp7-pvxv](https://github.com/advisories/GHSA-w9hf-3pp7-pvxv) 2026-06-18 ✅ 已收录
CVE-2026-53851 ✅ PUBLISHED | [GHSA-gxg4-2rrr-jhc7](https://github.com/advisories/GHSA-gxg4-2rrr-jhc7) 2026-06-18 ✅ 已收录
CVE-2026-53861 ✅ PUBLISHED | [GHSA-985f-72mj-8gf7](https://github.com/advisories/GHSA-985f-72mj-8gf7) 2026-06-18 ✅ 已收录
CVE-2026-28480 ✅ PUBLISHED | [GHSA-h89v-j3x9-8wqj](https://github.com/advisories/GHSA-h89v-j3x9-8wqj) 2026-02-18 ✅ 已收录
CVE-2026-29612 ✅ PUBLISHED | [GHSA-g34w-4xqq-h79m](https://github.com/advisories/GHSA-g34w-4xqq-h79m) 2026-02-18 ✅ 已收录
CVE-2026-53852 ✅ PUBLISHED | [GHSA-8j37-5w68-wj2g](https://github.com/advisories/GHSA-8j37-5w68-wj2g) 2026-06-18 ✅ 已收录
CVE-2026-53845 ✅ PUBLISHED | [GHSA-9v8j-9c9g-w66c](https://github.com/advisories/GHSA-9v8j-9c9g-w66c) 2026-06-18 ✅ 已收录
CVE-2026-53848 ✅ PUBLISHED | [GHSA-h9h6-pwqv-j9hv](https://github.com/advisories/GHSA-h9h6-pwqv-j9hv) 2026-06-18 ✅ 已收录

📢 安全公告精选

212+
GHSA-w4v6-g3w CRITICAL
OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
2026-07-02
GHSA-j472-gf5 HIGH
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
2026-07-02 CVE-2026-53836
GHSA-7hxm-f53 HIGH
OpenClaw: Matrix allowFrom could bind to mutable display names
2026-07-02 CVE-2026-53811
GHSA-3c6j-hq3 HIGH
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
2026-07-02 CVE-2026-53816
GHSA-vxx3-6hc HIGH
OpenClaw: Combined POSIX shell options could confuse exec revalidation
2026-07-02 CVE-2026-53806
GHSA-v8cx-933 HIGH
OpenClaw: Fake package roots could influence memory-core artifact loading
2026-07-02 CVE-2026-53813
GHSA-8wg3-5mc HIGH
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
2026-07-02 CVE-2026-53819
GHSA-77pv-3w4 HIGH
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
2026-07-02 CVE-2026-53834
GHSA-jvm4-4j7 HIGH
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
2026-07-02 CVE-2026-53833
GHSA-mhq8-78p HIGH
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
2026-07-02 CVE-2026-53831
GHSA-mgq6-vr8 HIGH
OpenClaw: QQBot native approval buttons did not enforce configured approver identity
2026-07-02 CVE-2026-35630
GHSA-6fvr-66p HIGH
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
2026-07-02 CVE-2026-53814

📊 漏洞分类

白名单绕过 (Allowlist Bypass)
60
注入攻击 (XSS/CSRF/Prompt/Command)
34
认证绕过 / 缺失认证
10
SSRF
5
拒绝服务 (DoS)
6
路径穿越 (CWE-22)
3
原型污染 (Prototype Pollution)
1

💡 关键洞察

📈
6.7
平均 CVSS 评分
🔴
186%
HIGH 及以上漏洞占比
⚡
100%
CVE 已发布到 cvelistV5
🛡️
100%
已提供修复版本
🏢
3
CNA 来源 (VulnCheck / GitHub / MITRE)
📦
npm
受影响包 (openclaw)