CVE-2026-17457

Name of the Vulnerable Software and Affected Versions mf-yang openclaw-cn versions prior to 0.2.2

Description A remote information disclosure issue exists in the Scheme Handler component. The problem resides in the assertBrowserNavigationAllowed() function within the src/browser/navigation-guard.ts file. An attacker can exploit this by manipulating the url argument to disclose sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict the use of the assertBrowserNavigationAllowed() function.