Snyk Security Database

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the download-file handler, which fails open when a file lacks the share metadata used to prove it belongs to the requested conversation. An authenticated caller restricted to a single conversation can download file contents from outside that conversation's scope by supplying a known file identifier, disclosing data across configured conversation boundaries. The issue does not allow listing arbitrary Slack files and does not bypass Slack authentication itself.

scrapetools2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

org.apache.karaf:org.apache.karaf.util is a modern and polymorphic applications container. It's a lightweight, powered, and enterprise ready container powered by OSGi

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper release of ClassLoader references via static ThreadLocal caching. An attacker can cause unbounded memory consumption and service disruption by repeatedly installing, updating, or refreshing bundles or features, which prevents garbage collection of ClassLoader instances.