GitHub Advisoryadvisory · npm

GHSA-jp4j-q5fc-58gv OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

MEDIUM Published 2026-03-31 Modified 2026-03-31 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weaknesses
CWE-862
Reviewed
2026-03-31

Affected packages

• npm openclaw: >= 2026.2.14, < 2026.3.28 → fixed in 2026.3.28

Description

Summary Discord button and component interaction ingress did not consistently reapply the same guild and channel policy gates used for normal inbound messages. Impact Users could trigger privileged component actions from contexts that should have been blocked by Discord channel policy. Affected Component `extensions/discord/src/monitor/agent-components.ts` Fixed Versions • Affected: `>= 2026.2.14, = 2026.3.28` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `511093d4b3` (`Discord: apply component interaction policy gates`).

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References