NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumptionGHSA-j26j-7qc4-3mrf

Fix: openclaw/openclaw@347f7b9

GHSA-j26j-7qc4-3mrf is a security vulnerability in openclaw. A fix is available for openclaw — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Mar 4, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

132other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
openclawnpm
3.4Mdownloads / week

Description

Summary

In openclaw MS Teams file-consent flow, pending uploads were authorized by uploadId alone. fileConsent/invoke did not verify the invoke conversation against the conversation that created the pending upload.

Impact

An attacker who obtained a valid uploadId within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path).

Technical Details

  • Pending uploads stored conversationId, but invoke handling consumed by uploadId only.
  • The invoke path did not enforce conversation binding before uploadToConsentUrl(...) and pending-upload removal.
  • Fix binds accept/decline handling to normalized conversation id match before consuming pending upload state.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published npm version (as of February 26, 2026): 2026.2.24
  • Vulnerable range: <= 2026.2.24
  • Patched in release: 2026.2.25

Remediation

Upgrade to openclaw 2026.2.25 (or later) once published.

Fix Commit(s)

  • 347f7b9550064f5f5b33c6e07f64e85b9657b6f1

Release Process Note

patched_versions is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmopenclawall versions2026.2.25npm install openclaw@2026.2.25

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update openclaw to 2026.2.25 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j26j-7qc4-3mrf is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload. ### Impact An attacker who obtained a valid `uploadId` within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path). ### Technical Details - Pending uploads stored `conversationId`, but invoke handling consumed by `uploadId` only. - The invoke path did not enforce conversation binding before `uploadToConsent
O3 Security · Impact-Aware SCA

Is GHSA-j26j-7qc4-3mrf in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
OpenClaw: MS Teams fileConsent/invoke missing…