{"data":{"id":"c768804d-cb2b-497b-a49e-23988d99d45c","title":"GHSA-x2ff-j5c2-ggpr: OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows","summary":"OpenClaw, a Slack integration tool, had a security flaw where some interactive callbacks (actions triggered by users in Slack, like button clicks) could skip sender authorization checks in shared workspaces. This meant an unauthorized workspace member could inject system messages into an active session, though the flaw did not allow unauthenticated access or broader system compromise.","solution":"Update to OpenClaw version 2026.2.25 or later. The fix is included in npm release 2026.2.25, which addresses the authorization check bypass in interactive callbacks.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-x2ff-j5c2-ggpr","publishedAt":"2026-03-04T18:55:19.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["openclaw@<= 2026.2.24 (fixed: 2026.2.25)"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}