~ / search / GHSA-v2v2-f783-358j

GHSA-v2v2-f783-358j

OpenClaw: Zalo channel downloads media before sender authorization

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-33576

Packages

EcosystemPackageAffectedFixed in
npm openclaw < 2026.3.28 2026.3.28

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary The Zalo image path fetched and stored inbound media before the DM/pairing authorization checks ran. ## Impact Unauthorized senders could force network fetches and disk writes in the inbound media store even when the message itself was rejected. ## Affected Component `extensions/zalo/src/monitor.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `68ceaf7a5f` (`zalo: gate image downloads before DM auth`). OpenClaw thanks @AntAISecurityLab for reporting.

References

External links from the advisory. They lead to third-party sites.