Skip to content
OpenAdvisories

Package · npm

clawdbot

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low —
    GHSA-chm2-m3w2-wcxm

    OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch

    ### Summary Google Chat allowlisting supports matching by sender email in addition to immutable sender resource name (`users/<id>`). This weakens identity binding if a deployment assumes allowlists are strictly keyed by immutable principals. ### Affected Pack…

    openclaw clawdbot npm