mediumCVSS 5.3Vulnerability
GHSA-c8w7-9w9h-x69q
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcvx-5cxc-v5p8. This link is maintained to preserve external references. ## Original Description OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.
Properties
- ghsa_id
- GHSA-c8w7-9w9h-x69q
- severity
- medium
- summary
- Duplicate Advisory: Slack reaction events could ignore reaction notification settings
- cvss_score
- 5.3
- cve_id
- GHSA-c8w7-9w9h-x69q
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- is_ghsa_only
- true
- ghsa_published
- 2026-06-16T21:31:58Z
- source_url
- https://github.com/advisories/GHSA-c8w7-9w9h-x69q
- ghsa_updated
- 2026-06-18T20:13:00Z
Related Entities (4)
VULNERABLE_TO (1)
←[Software]npm/openclaw
AFFECTS (1)
→[Software]npm/openclaw
HAS_WEAKNESS (1)
→[Weakness]Missing Authorization
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph