https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:27:52 +0000 https://vulnerability.circl.lu/vuln/cve-2026-28479 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collision attacks. An attacker can exploit SHA-1 collisions to cause cache poisoning, allowing one sandbox configuration to be misinterpreted as another and enabling unsafe sandbox state reuse.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collision attacks. An attacker can exploit SHA-1 collisions to cause cache poisoning, allowing one sandbox configuration to be misinterpreted as another and enabling unsafe sandbox state reuse.</p> https://vulnerability.circl.lu/vuln/cve-2026-28479 https://vulnerability.circl.lu/vuln/ghsa-fh3f-q9qw-93j9 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions - npm package: `openclaw` - Affected versions: `&lt;= 2026.2.14` - Fixed version (pre-set): `2026.2.15`</p> <p>## Description The sandbox identifier cache key for Docker/browser sandbox configuration used SHA-1 to hash normalized configuration payloads.</p> <p>SHA-1 is deprecated for cryptographic use and has known collision weaknesses. In this code path, deterministic IDs are used to decide whether an existing sandbox container can be reused safely. A collision in this hash could let one configuration be interpreted as another under the same sandbox cache identity, increasing the risk of cache poisoning and unsafe sandbox state reuse.</p> <p>The implementation now uses SHA-256 for these deterministic hashes to restore collision resistance for this security-relevant identifier path.</p> <p>## Fix Commit(s) - `559c8d993`</p> <p>## Release Process Note `patched_versions` is pre-set to `2026.2.15` for the next release. After that release is published, mark this advisory ready for publication.</p> <p>Thanks @kexinoh ( of Tencent zhuque Lab, by https://github.com/Tencent/AI-Infra-Guard) for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions - npm package: `openclaw` - Affected versions: `&lt;= 2026.2.14` - Fixed version (pre-set): `2026.2.15`</p> <p>## Description The sandbox identifier cache key for Docker/browser sandbox configuration used SHA-1 to hash normalized configuration payloads.</p> <p>SHA-1 is deprecated for cryptographic use and has known collision weaknesses. In this code path, deterministic IDs are used to decide whether an existing sandbox container can be reused safely. A collision in this hash could let one configuration be interpreted as another under the same sandbox cache identity, increasing the risk of cache poisoning and unsafe sandbox state reuse.</p> <p>The implementation now uses SHA-256 for these deterministic hashes to restore collision resistance for this security-relevant identifier path.</p> <p>## Fix Commit(s) - `559c8d993`</p> <p>## Release Process Note `patched_versions` is pre-set to `2026.2.15` for the next release. After that release is published, mark this advisory ready for publication.</p> <p>Thanks @kexinoh ( of Tencent zhuque Lab, by https://github.com/Tencent/AI-Infra-Guard) for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-fh3f-q9qw-93j9