https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T19:06:00.667829+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-43534 CVE-2026-43534 — OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events 2026-09-28T19:06:00.672104+00:00

Affected: OpenClaw

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

 https://vulnerability.circl.lu/vuln/ghsa-7g8c-cfr3-vqqr GHSA-7g8c-cfr3-vqqr — OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input 2026-09-28T19:06:00.672237+00:00

Affected: npm: openclaw

## Summary

Agent hook events could enqueue trusted system events from unsanitized external input.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Agent hook dispatch could turn externally supplied hook metadata into trusted system events, allowing untrusted input to enter the agent as higher-trust context.

## Technical Details

The fix sanitizes hook names and marks agent hook system events as untrusted before enqueueing them.

## Fix

The issue was fixed in #64372. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `e3a845bde5b54f4f1e742d0a51ba9860f9619b29` - PR: #64372

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.