GHSA-jw7v-5mp7-ghgm

Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs

Published

2026-07-14

Modified

2026-10-21

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3x84-qq85-fj65. This link is maintained to preserve external references. ## Original Description OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

Affected packages

Remediation: Upgrade to 2026.6.6 or later.

References

• https://github.com/advisories/GHSA-jw7v-5mp7-ghgm