GitHub Advisoryadvisory · npm

GHSA-g86v-f9qv-rh6m OpenClaw SSRF guard misses four IPv6 special-use ranges

LOW Published 2026-03-31 Modified 2026-03-31 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2026-03-31

Affected packages

• npm openclaw: < 2026.3.28 → fixed in 2026.3.28

Description

Summary The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed fetches to proceed. Impact An attacker who controlled a fetched URL could target internal or non-routable IPv6 addresses that should have been blocked by the SSRF guard. Affected Component `src/shared/net/ip.ts, src/infra/net/ssrf.*` Fixed Versions • Affected: `= 2026.3.28` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `d61f8e5672` (`Net: block missing IPv6 special-use ranges`). OpenClaw thanks @nicky-cc of Tencent zhuque Lab https://github.com/Tencent/AI-Infra-Guard for reporting.

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References