Depthfirstdisclosures

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.1.29 **Description** OpenClaw (also known as ClawdBot or MoltBot) contains a flaw where the Control UI trusts the `gatewayUrl` parameter from the query string without proper validation. Upon page load, the application automatically establishes a WebSocket connection to this URL and sends the stored gateway token in the connection payload. An attacker can exploit this by tricking a user into clicking a specially crafted link or visiting a malicious website, which exfiltrates the token to a server controlled by the attacker. With this token, the attacker gains operator-level access to the gateway API, allowing them to modify configurations (such as sandbox and tool policies) and invoke privileged actions. This can lead to full gateway compromise and one-click remote code execution (RCE) on the host machine. The issue persists even if the gateway is configured to listen only on the loopback interface, as the victim's browser initiates the outbound connection. **Recommendations** Update OpenClaw to version 2026.1.29 or later. As a temporary mitigation, restrict access to the Control UI and avoid clicking untrusted links while the session is active.

**Name of the Vulnerable Software and Affected Versions** Sandboxie versions 1.16.6 and below **Description** Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. The SYSTEM-level service `SbieSvc.exe` exposes the `SbieIniServer::RC4Crypt` function to sandboxed processes. This function adds a fixed header size to a caller-controlled `value len` without performing adequate overflow checks. Providing a large `value len` (for example, 0xFFFFFFF0) causes the allocation size to wrap around, resulting in a heap overflow when attacker-controlled data is copied into a buffer that is too small. Successful exploitation allows sandboxed processes to execute arbitrary code with SYSTEM privileges, leading to full host compromise. **Recommendations** Update Sandboxie to version 1.16.7 or later.

**Name of the Vulnerable Software and Affected Versions** Swetrix Web Analytics API versions prior to 7d8b972 **Description** A directory traversal issue exists in Swetrix Web Analytics API 3.1.1 before commit 7d8b972. This allows a remote attacker to achieve Remote Code Execution via a crafted HTTP request. **Recommendations** Update Swetrix Web Analytics API to version 7d8b972 or later.