npm/openclaw CVE-2026-35642: medium 4.3, EPSS 0.20%

OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-mw7w-g3mg-xqm7
• nvd: CVE-2026-35642
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mw7w-g3mg-xqm7
• https://github.com/openclaw/openclaw/commit/f8c98630785288cc1f1d0893503ef3b653a3cede
• https://github.com/openclaw/openclaw

CVE-2026-35642 · published 2026-03-27T22:32:06Z · modified 2026-07-08T08:27:06.222886417Z · JSON