GHSA-v773-r54f-q32w OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands

• npm openclaw: < 2026.2.14 → fixed in 2026.2.14

Summary When Slack DMs are configured with `dmPolicy=open`, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions. Affected Packages / Versions • Package: `openclaw` (npm) • Affected versions: `<= 2026.2.13` • Affected configuration: Slack DMs enabled with `channels.slack.dm.policy: open` (aka `dmPolicy=open`) Impact Any Slack user in the workspace who can DM the bot could invoke privileged slash commands via DM. Fix The slash-command path now computes `CommandAuthorized` for DMs using the same allowlist/access-group gating logic as other inbound paths. Fix commit(s): • f19eabee54c49e9a2e264b4965edf28a2f92e657 Release Process Note `patched_versions` is set to the planned next release (`2026.2.14`). Once that npm release is published, this advisory should be published. Thanks @christos-eth for reporting.