Trumpchen

**Name of the Vulnerable Software and Affected Versions** nanocoai NanoClaw versions prior to 2.0.65 **Description** Improper privilege management exists within the Child-Agent Creation component. The issue resides in the `handleCreateAgent()` function located in the `src/modules/agent-to-agent/create-agent.ts` file, which allows for remote exploitation through manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `handleCreateAgent()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mf-yang openclaw-cn version 2026.2.5 **Description** An issue exists in the Ggateway Exec Approval Flow component within the file `src/agents/bash-tools.exec.ts`. Remote manipulation of this component can lead to incorrect authorization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mf-yang openclaw-cn versions prior to 0.2.2 **Description** Improper privilege management exists in the `isApprovedElevatedSender()` function within the `src/auto-reply/reply/reply-elevated.ts` file. This flaw allows a remote attacker to manipulate privilege levels. **Recommendations** As a temporary workaround, consider restricting the use of the `isApprovedElevatedSender()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mf-yang openclaw-cn versions prior to 0.2.2 **Description** A remote attack is possible in the apply patch Tool component due to an issue in the `assertNoSymlinkEscape()` function within the src/agents/sandbox-paths.ts file. This flaw allows for link following, which occurs when a program follows a symbolic link to a location outside the intended directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `assertNoSymlinkEscape()` function to minimize the risk of exploitation.