Homepage

@openclaw/discord@2026.8.33

OpenClaw Discord channel plugin for channels, DMs, commands, and app events.

  • latest version

    2026.9.6

  • latest non vulnerable version

    2026.9.6

  • first published

    8 months ago

  • latest version published

    6 days ago

  • View discord package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @openclaw/discord package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Missing Authorization

    @openclaw/discord is an OpenClaw Discord channel plugin

    Affected versions of this package are vulnerable to Missing Authorization via the emoji and sticker upload actions, which drop the sender-scoped media policy before loading a local file. A sender permitted to invoke those actions can cause the integration to read a host path that the sender's configured media roots would otherwise reject, placing bytes from an out-of-policy local file into an outbound emoji or sticker upload.

    Note: This is only exploitable if the attacker has access to the guild asset action and knowledge or derivation of a useful local path.

    How to fix Missing Authorization?

    Upgrade @openclaw/discord to version 2026.9.3 or higher.

    <2026.9.3
    Go back to all versions of this package