Eqstlab

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected.

**Name of the Vulnerable Software and Affected Versions** @opentelemetry/propagator-jaeger versions prior to 2.9.0 **Description** The @opentelemetry/propagator-jaeger component decodes incoming `uber-trace-id` and `uberctx-*` HTTP header values using the `decodeURIComponent()` function without proper error handling. An unauthenticated remote attacker can send a malformed percent-encoded value, triggering an uncaught URIError (a type of error occurring when the URI decoding function encounters an invalid sequence) that terminates the Node.js process utilizing the `JaegerPropagator` as the active propagator. **Recommendations** Update to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** @rtk-ai/rtk-rewrite version 1.0.0 **Description** The @rtk-ai/rtk-rewrite OpenClaw plugin fails to properly escape input passed to a shell-backed `execSync()` function. While `JSON.stringify()` is used to wrap values in double quotes, it does not neutralize shell metacharacters such as `$()` and backticks. Since `execSync()` delegates execution to `/bin/sh -c`, the shell performs command substitution within double-quoted strings. An attacker capable of influencing the `command` parameter of the exec tool, such as through an LLM agent prompt or gateway input, can execute arbitrary operating system commands with the privileges of the plugin or gateway process. **Recommendations** Update @rtk-ai/rtk-rewrite to a version newer than 1.0.0. As a temporary mitigation, restrict or sanitize the `command` parameter used in the exec tool to prevent the injection of shell metacharacters.

**Name of the Vulnerable Software and Affected Versions** Pi versions prior to 0.79.0 **Description** Pi loaded project-local configuration and resources from a repository's `.pi` directory, including executable TypeScript or JavaScript modules known as project-local extensions, without requiring the user to trust the repository. Because extensions are not sandboxed and run within the Pi process, an attacker controlling a repository could execute arbitrary code with the same privileges as the local Pi process if a user started Pi from that working tree. This allows access to files, environment variables, credentials, the network, and local tools available to the user. The issue resides in the project resource loading path, where `.pi/settings.json`, auto-discovered resources, package-managed resources, and project instruction files were loaded during session initialization before a trust boundary was established. **Recommendations** Update Pi to version 0.79.0 or later. As a temporary workaround, avoid running Pi in untrusted repositories or use an external operating-system sandbox, container, or VM to isolate the execution environment. Inspect and remove project-local Pi configuration and resources, specifically project-local extensions and package configuration, before use in untrusted repositories.