GHSA-77w2-crqv-cmv3
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
## Affected Packages / Versions
- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`
## Details
Feishu raw card sends could previously mint legacy callback payloads that bypassed DM pairing and let unpaired recipients reach callback handling. Commit `81c45976db532324b5a0918a70decc19520dc354` rejects legacy raw-card command payloads so callbacks stay on the normal paired path.
Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `81c45976db532324b5a0918a70decc19520dc354`.
## Fix Commit(s)
- `81c45976db532324b5a0918a70decc19520dc354`
References
External links from the advisory. They lead to third-party sites.