0Xacb

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.1.29 **Description** An authentication bypass issue exists in the WebSocket gateway of OpenClaw. The software fails to validate the user-supplied `gatewayUrl` parameter before initializing WebSocket connections. This allows unauthenticated remote attackers to exfiltrate bearer tokens and perform server-side request forgery (SSRF), which is a technique where an attacker forces a server to make requests to internal or external resources. Exploitation can lead to the disclosure of authentication tokens, theft of cloud metadata and IAM credentials, and full compromise of connected automation workflows. In some configurations, this can allow attackers to execute arbitrary code on the host machine, potentially granting access to the file system and shell. Active exploitation has been observed in the wild. **Recommendations** Upgrade to OpenClaw version 2026.1.29 or later. Restrict external access to OpenClaw dashboard endpoints. Deploy WAF rules to block malicious `gatewayUrl` values. Enforce strict egress filtering. Rotate all exposed credentials.

Name of the Vulnerable Software and Affected Versions: stripe-cli versions 1.11.1 through 1.21.2 Description: A path traversal vulnerability exists in stripe-cli where a plugin package containing a manifest with a malformed plugin shortname installed using the `--archive-url` or `--archive-path` flags can overwrite arbitrary files. The update in version 1.21.3 addresses this issue by removing the ability to install plugins from an archive URL or path. There has been no evidence of exploitation of this vulnerability. Recommendations: Upgrade to stripe-cli version 1.21.3. As a temporary workaround, consider disabling the installation of plugins from archive URLs or paths until the update is applied. Restrict access to the `--archive-url` and `--archive-path` flags to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Git versions prior to 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1 **Description** The issue is related to insufficient neutralization of special elements in a request, which can allow an attacker to execute arbitrary code. A specially crafted `.gitmodules` file with submodule URLs longer than 1024 characters can be used to exploit a bug in `config.c::git config copy or rename section in file()`. This bug can inject arbitrary configuration into a user's `$GIT DIR/config` when attempting to remove the configuration section associated with that submodule. The attacker can inject configuration values that specify executables to run, such as `core.pager`, `core.editor`, `core.sshCommand`, etc., leading to remote code execution. **Recommendations** To resolve the issue, update to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, or 2.40.1. As a temporary workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT DIR/config`.