Homepage

@openclaw/synology-chat@2026.5.1-beta.1

Synology Chat channel plugin for OpenClaw channels and direct messages.

  • latest version

    2026.7.1

  • latest non vulnerable version

    2026.9.1-beta.1

  • first published

    6 months ago

  • latest version published

    1 months ago

  • View synology-chat package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @openclaw/synology-chat package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Weak Password Requirements

    @openclaw/synology-chat is a Synology Chat channel plugin for OpenClaw

    Affected versions of this package are vulnerable to Weak Password Requirements due to insufficient rate limiting in the webhook authentication process. An attacker can repeatedly guess weak webhook tokens by sending numerous authentication attempts without being throttled.

    How to fix Weak Password Requirements?

    Upgrade @openclaw/synology-chat to version 2026.5.2 or higher.

    <2026.5.2
    • M
    Improper Authorization

    @openclaw/synology-chat is a Synology Chat channel plugin for OpenClaw

    Affected versions of this package are vulnerable to Improper Authorization in the webhook process. An attacker can gain unauthorized access to direct message policies by exploiting a path collision in the multi-account configuration, allowing replacement of route ownership and bypassing intended policy separation.

    How to fix Improper Authorization?

    Upgrade @openclaw/synology-chat to version 2026.5.2 or higher.

    <2026.5.2
    • H
    Use of Incorrectly-Resolved Name or Reference

    @openclaw/synology-chat is a Synology Chat channel plugin for OpenClaw

    Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the webhook-handler process. An attacker can redirect message replies to an unintended user by exploiting mutable username resolution instead of relying on a stable user identifier.

    How to fix Use of Incorrectly-Resolved Name or Reference?

    Upgrade @openclaw/synology-chat to version 2026.5.2 or higher.

    <2026.5.2
    • M
    Incorrect Authorization

    @openclaw/synology-chat is a Synology Chat channel plugin for OpenClaw

    Affected versions of this package are vulnerable to Incorrect Authorization in the synology-chat channel plugin when dmPolicy is set to allowlist and allowedUserIds is empty or unset. An attacker can trigger unauthorized agent or tool actions by sending messages as an unauthorized Synology sender. This is only exploitable if the optional synology-chat channel plugin is enabled and configured with dmPolicy=allowlist and an empty or unset allowedUserIds.

    How to fix Incorrect Authorization?

    Upgrade @openclaw/synology-chat to version 2026.5.2 or higher.

    >=2026.2.22 <2026.5.2
    Go back to all versions of this package