GitHub Advisoryadvisory · npm

GHSA-h656-5vcf-cm23 OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

MEDIUM Published 2026-03-03 Modified 2026-03-03 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
Moderate
Weaknesses
CWE-208, CWE-404, CWE-406, CWE-770
Reviewed
2026-03-03

Affected packages

• npm openclaw: < 2026.2.24 → fixed in 2026.2.24

Description

Impact In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be denied. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published version currently affected: `2026.2.23` • Vulnerable range: `= 2026.2.24` as patched.

Related

Weakness · CWE (4)

  • CWE-208 Observable Timing Discrepancy weakness
  • CWE-404 Improper Resource Shutdown or Release weakness
  • CWE-406 Insufficient Control of Network Message Volume (Network Amplification) weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References