MEDIUM 5.4 npm
OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist
GHSA-rvvf-6vh3-9j43 · CVE-2026-41348
Published · Modified
Description
Summary
Discord Slash Commands Bypass Group DM Channel Allowlist
Current Maintainer Triage
- Status: narrow
- Normalized severity: moderate
- Assessment: v2026.3.28 native Discord slash and autocomplete paths still skip the group-DM allowlist, but impact is limited to already-authorized Discord users bypassing a channel restriction rather than crossing a stronger trust boundary.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
8fdb19676ab44cf85d47ee13c578195f2e527591— 2026-03-30T11:17:36-06:00
OpenClaw thanks @nexrin for reporting.
References
- WEB https://github.com/openclaw/openclaw/security/advisories/GHSA-rvvf-6vh3-9j43
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-41348
- WEB https://github.com/openclaw/openclaw/commit/8fdb19676ab44cf85d47ee13c578195f2e527591
- PACKAGE https://github.com/openclaw/openclaw
- WEB https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
- WEB https://www.vulncheck.com/advisories/openclaw-group-dm-channel-allowlist-bypass-via-discord-slash-commands
Ready to move
Start Securing
Free, no credit card | First findings in minutes