AI agent vulnerability · OpenClaw

CVE-2026-35637: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

mediumCVSS 4.0 5.3GHSA-vfg3-pqpq-93m4

Summary Tlon cite expansion happened before channel and DM authorization completed, allowing cite work and content handling before the final auth decision. Affected Packages / Versions - Package: openclaw (npm) - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) -…

Published Mar 26, 2026 · Updated Apr 10, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.3.22
Fixed in: 2026.3.22
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Tlon cite expansion happened before channel and DM authorization completed, allowing cite work and content handling before the final auth decision.

Affected Packages / Versions

Package: openclaw (npm)
Affected: < 2026.3.22
Fixed: >= 2026.3.22
Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

3cbf932413e41d1836cb91aed1541a28a3122f93
ebee4e2210e1f282a982c7ef2ad79d77a572fc87

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

extensions/tlon/src/monitor/index.ts now defers cite expansion until after authorization and preserves explicit empty-allowlist semantics.
extensions/tlon/src/monitor/utils.ts and extensions/tlon/src/security.test.ts ship the deferred cite expansion behavior and regressions.

OpenClaw thanks @zpbrent for reporting.

Credited to zpbrent.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries