Publish Advisories

GHSA-jccr-rrw2-vc8h
GHSA-q4r8-xm5f-56gw
GHSA-8jxr-pr72-r468
GHSA-f37v-82c4-4x64
GHSA-f3pv-wv63-48x8
GHSA-gvrj-cjch-728p
GHSA-hfpq-x728-986j
GHSA-pr46-2v3c-5356

Author: advisory-database[bot]

advisories/github-reviewed/2026/03/GHSA-jccr-rrw2-vc8h/GHSA-jccr-rrw2-vc8h.json

@@ -1,11 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jccr-rrw2-vc8h",
-  "modified": "2026-03-31T23:56:13Z",
+  "modified": "2026-04-08T11:58:00Z",
   "published": "2026-03-31T23:56:13Z",
   "aliases": [],
   "summary": "OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure",
-  "details": "## Summary\n\nThe jq safe-bin policy blocked explicit `env` usage but still allowed jq programs that accessed environment data through `$ENV`.\n\n## Impact\n\nAn operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.\n\n## Affected Component\n\n`src/infra/exec-safe-bin-semantics.ts`\n\n## Fixed Versions\n\n- Affected: `<= 2026.3.24`\n- Patched: `>= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `78e2f3d66d` (`Exec: tighten jq safe-bin env checks`).\n\nOpenClaw thanks @nicky-cc  of Tencent zhuque Lab [https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard) for reporting.",
+  "details": "## Summary\n\nThe jq safe-bin policy blocked explicit `env` usage but still allowed jq programs that accessed environment data through `$ENV`.\n\n## Impact\n\nAn operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.\n\n## Affected Component\n\n`src/infra/exec-safe-bin-semantics.ts`\n\n## Fixed Versions\n\n- Affected: `<= 2026.3.24`\n- Patched: `>= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `78e2f3d66d` (`Exec: tighten jq safe-bin env checks`).\n\nThanks @nicky-cc  of Tencent zhuque Lab ([https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)) for reporting.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -52,6 +52,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-185",
       "CWE-200"
     ],
     "severity": "HIGH",

advisories/github-reviewed/2026/03/GHSA-q4r8-xm5f-56gw/GHSA-q4r8-xm5f-56gw.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q4r8-xm5f-56gw",
-  "modified": "2026-04-06T17:19:40Z",
+  "modified": "2026-04-08T11:57:49Z",
   "published": "2026-03-19T16:27:53Z",
   "aliases": [
     "CVE-2026-30836"

advisories/github-reviewed/2026/04/GHSA-8jxr-pr72-r468/GHSA-8jxr-pr72-r468.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8jxr-pr72-r468",
-  "modified": "2026-04-07T20:13:32Z",
+  "modified": "2026-04-08T11:57:14Z",
   "published": "2026-04-07T20:13:32Z",
   "aliases": [
     "CVE-2026-35568"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-8jxr-pr72-r468"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35568"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/modelcontextprotocol/java-sdk"
@@ -56,6 +60,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-04-07T20:13:32Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-04-07T22:16:23Z"
   }
 }

advisories/github-reviewed/2026/04/GHSA-f37v-82c4-4x64/GHSA-f37v-82c4-4x64.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f37v-82c4-4x64",
-  "modified": "2026-04-07T15:52:29Z",
+  "modified": "2026-04-08T11:57:06Z",
   "published": "2026-04-07T15:52:28Z",
   "aliases": [
     "CVE-2026-34781"
@@ -97,6 +97,10 @@
       "type": "WEB",
       "url": "https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34781"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/electron/electron/pull/50475"
@@ -133,6 +137,6 @@
     "severity": "LOW",
     "github_reviewed": true,
     "github_reviewed_at": "2026-04-07T15:52:28Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-04-07T22:16:23Z"
   }
 }

advisories/github-reviewed/2026/04/GHSA-f3pv-wv63-48x8/GHSA-f3pv-wv63-48x8.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f3pv-wv63-48x8",
-  "modified": "2026-04-07T15:52:25Z",
+  "modified": "2026-04-08T11:57:01Z",
   "published": "2026-04-07T15:52:25Z",
   "aliases": [
     "CVE-2026-34765"
@@ -97,6 +97,10 @@
       "type": "WEB",
       "url": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34765"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/electron/electron"
@@ -125,6 +129,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-04-07T15:52:25Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-04-07T22:16:22Z"
   }
 }

advisories/github-reviewed/2026/04/GHSA-gvrj-cjch-728p/GHSA-gvrj-cjch-728p.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hfpq-x728-986j",
-  "modified": "2026-04-07T20:13:04Z",
+  "modified": "2026-04-08T11:57:10Z",
   "published": "2026-04-07T20:13:04Z",
   "aliases": [
     "CVE-2026-35406"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/containers/aardvark-dns/security/advisories/GHSA-hfpq-x728-986j"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35406"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1"
@@ -63,6 +67,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-04-07T20:13:04Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-04-07T22:16:23Z"
   }
 }

advisories/github-reviewed/2026/04/GHSA-hfpq-x728-986j/GHSA-hfpq-x728-986j.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pr46-2v3c-5356",
-  "modified": "2026-04-08T00:18:46Z",
+  "modified": "2026-04-08T11:57:19Z",
   "published": "2026-04-08T00:18:46Z",
   "aliases": [
     "CVE-2026-39847"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/emmett-framework/emmett/security/advisories/GHSA-pr46-2v3c-5356"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39847"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/emmett-framework/emmett"
@@ -52,6 +56,6 @@
     "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2026-04-08T00:18:46Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-04-07T22:16:23Z"
   }
 }