OpenClaw publishes 75 security advisories in one day (2026-09-11) for bugs fixed in 2026.7.1–2026.8.1 — 30 rated High: non-owner senders reaching owner-only tools, MCP config injection to RCE, exec approvals that outlive their directory, a gcloud argument injection

TL;DR

On 2026-09-11 the OpenClaw project published 75 GitHub Security Advisories in a single day — 30 High, 40 Moderate, 5 Low — for bugs already fixed in releases between 2026.7.1 and 2026.8.1 (2026.8.1 shipped 2026-08-31). No CVE ids, no blog post, no press coverage; the only record is the project's own advisory index, which also carries a second, previously untracked batch of ~30 advisories dated 2026-06-30 (fixed 2026.6.8). The dominant theme is authorization that stops at the channel boundary: a non-owner sender on WhatsApp, Slack, Discord, Matrix, Signal, Teams or a voice call could reach owner-only tools, change MCP server configuration (a stdio command, so code execution on the host), install plugins, re-pair accounts, or reuse an operator's standing exec approval in a directory it was never reviewed for. If you run OpenClaw with any external channel connected, upgrade to ≥ 2026.8.1 and audit what non-owners could have done in the meantime.

What happened

OpenClaw — the autonomous personal-agent framework this repo already tracks for Claw Chain and the NemoClaw bulletin — discloses almost exclusively through its own GitHub Security Advisories tab. This sweep walked that index directly (eleven pages, per this repo's standing vendor-index practice) and found that every one of the first 75 advisories carries the same publication date, 2026-09-11, while their patched versions are 2026.7.1 or 2026.8.1 — so the fixes were live for two to ten weeks before the advisories existed. That is the "advisory-database date is not a disclosure date" pattern, inverted: here the vendor back-published, and a sweep sorting by date sees 75 "new" bugs that are all already fixed.

Sampled advisories (all fetched directly from the vendor's advisory pages; CVSS as stated by the project; no CVE assigned to any of them):

What the sampled ones actually let an attacker do:

• MCP config injection → host code execution (8.8). An authorized non-owner sender on an external channel could run /mcp set / /mcp unset and persist Gateway MCP server configuration. A stdio MCP server entry is a command line, so this is arbitrary command execution with the OpenClaw process's privileges (CWE-862 + CWE-78). The project's interim advice is to disable MCP chat commands in external channels and audit existing MCP server entries for anything you did not add.
• Owner-only tools reachable by non-owners (8.3, 8.1, and roughly twenty Moderate/High siblings). Skill-backed tool dispatch did not carry the sender's owner status, so non-owners could reach owner-restricted tools "depending on which owner-only tools were exposed by installed skills." The WhatsApp login tool was exposed through the generic channel-tool path: a non-owner could force a re-login, obtain the QR code, and disconnect or replace the account. The same shape recurs across the batch — chat.send exposing owner-only infrastructure tools, message.action trusting spoofed requester provenance, Claude permission replies and Codex bind/install omitting owner authorization, Slack group DMs skipping sender allowlists, inbound voice calls inheriting owner tool authority, Discord realtime transcripts inheriting another speaker's owner status.
• Standing exec approvals that drift (7.3, plus three sibling Highs). An allow-always approval matched a command's arguments but not its working directory, so a later run could execute the approved command somewhere with "materially different read or write effects." Sibling advisories: reusable approvals authorizing changed arguments, escaped newlines confusing allowlist parsing, and exec-wrapper allowlists trusting arbitrary inner commands.
• Argument injection into gcloud (7.8). An untrusted workspace configuration could set CLOUDSDK_PYTHON_ARGS, which Gmail setup inherited when launching gcloud, so the trusted Python interpreter executed attacker-supplied code as the host user. This is the same "config file you did not write becomes an environment variable that becomes code" class as aider's .aider.conf.yml and GitSpawn.
• Offline password cracking from a redacted config (7.5). Redacted configuration responses kept deterministic hashes computed from the unredacted values; with a low-entropy Gateway password those hashes are an offline verifier that bypasses the Gateway's rate limiting. Use a high-entropy Gateway credential or secret references.
• Memory "dreaming" as a privilege-escalation channel (7.5). Session-derived memory captured from a restricted sender lost that sender's restrictions before a later background dreaming run processed it — so a low-privilege sender could plant instructions that a background agent later executed with broader tool access. This is stored prompt injection through the agent's own memory layer.
• Case-folded identities (7.5). @openclaw/matrix lowercased whole user IDs including the case-sensitive server-name portion, so two protocol-valid Matrix accounts could normalise to the same authorization identity and inherit each other's allowlist, owner-command, exec-approval and plugin-approval rights.
• OpenShell sandbox TOCTOU (7.8). remove/mkdir/rename could act on a different filesystem target after the sandbox path-safety check completed.

Other High-rated titles in the batch (listed from the index; not individually fetched): iOS Control UI not enforcing saved Gateway TLS pins; Codex native tools ignoring per-chat policy; Synology file delivery losing DNS pinning; Gateway upgrade-like requests retaining unauthenticated sockets; browser CDP connections discarding DNS pinning; the agent cron tool reaching operator command jobs; cron accepting mixed-case command payloads; browser proxy missing its admin scope; browser node targets bypassing sandbox host control; Signal reactions binding to the wrong approval; Google Meet node commands skipping exec approvals.

The June batch nobody logged either. Pages 8–11 of the same index carry roughly thirty more advisories dated 2026-06-30 (one sampled: GHSA-jhfx-v2j8-x3m6, OpenAI-compatible HTTP model overrides missing admin authorization, CVSS 7.6, fixed 2026.6.8) and three dated 2026-05-28, with titles including host-exec environment filtering missing interpreter and rustup startup variables, sandbox bind mounts bypassing parent-directory denylists, MCP loopback exposing owner-only tools to non-owner runs, plugin install commands allowing non-owner persistence, and MCP SSE redirects forwarding Authorization headers. None of these appear elsewhere in this repo. Treat < 2026.8.1 as affected by both batches.

What the release notes said. The 2026.8.1 release (2026-08-31) describes masked credential prompts, plugin-trust review, provenance warnings for arbitrary plugin sources, and protected-credential egress — hardening, not a list of fixed vulnerabilities. A reader following release notes alone had no way to know 75 advisories were coming.

Update 2026-09-23 — a CVE lands on one of these, six weeks later. VulnCheck (as CNA) assigned CVE-2026-95815 on 2026-09-22 to the iOS deep-link advisory already in this batch (GHSA-5j57-84cx-r295, now also carried as GHSA-wjj6-g7c3-q75f): "OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data," so anyone who obtains a diagnostic archive recovers unrotated keys and replays them in forged deep links to submit agent requests without the local confirmation prompt (CWE-532, CVSS 4.0 7.2 / 3.1 6.3, fixed 2026.8.11, credit Jason O'Neal). It is the first CVE attached to any advisory in this batch — a reminder that the CVE layer arrives weeks after the vendor fix, and that a CVE-feed-only monitor would surface this now while the fix has been out since August. If you rotate to 2026.8.11+, also rotate any Gateway bearer keys that appeared in an iOS diagnostic archive.

Am I affected?

# Core version — need >= 2026.8.1 (2026.7.1 closes only part of the batch)
openclaw --version 2>/dev/null || npm ls -g openclaw 2>/dev/null

# Channel plugins carry their own advisories
npm ls -g @openclaw/whatsapp @openclaw/matrix 2>/dev/null

# Anything below the fix line, with an external channel connected, is in scope:
#   - review MCP server entries you did not add (GHSA-wwx7-573h-pqwc)
#   - review standing exec approvals and plugin installs made by non-owner senders
#   - check whether Gmail setup ran from an untrusted workspace (GHSA-5mrc-77hj-xjxv)

You are affected if you ran any release before 2026.8.1 with at least one external channel (WhatsApp, Slack, Discord, Matrix, Signal, Teams, Feishu, LINE, QQBot, Telegram, voice) that non-owners could message, or with skills that expose owner-only tools, or with session-memory capture plus dreaming enabled for restricted senders. A single-user OpenClaw on loopback with no external channels is exposed mainly to the workspace-config and sandbox items.

If you are affected

1. Upgrade openclaw and every @openclaw/* channel package to ≥ 2026.8.1 (current is 2026.9.4).
2. Audit Gateway MCP server configuration, plugin list, cron jobs, and standing exec approvals; remove anything you cannot account for. An MCP stdio entry you did not add is a confirmed compromise signal.
3. Rotate the Gateway password (use a high-entropy value or a secret reference) and any provider keys the Gateway held — the config-hash and embedding-fallback advisories both leak credential material.
4. Re-pair WhatsApp/Matrix/Signal accounts if a non-owner could have triggered a login.
5. → playbooks/if-your-local-ai-agent-was-exploited.md
6. → playbooks/rotating-cloud-credentials.md

Prevention

• Agent sandboxing — the OpenShell race and bind-mount items show the sandbox itself needs the update, not just the agent.
• MCP hygiene — MCP configuration is a command line; nobody but the operator should be able to write it.
• Credential hygiene
• Keep OpenClaw on the latest release and stop reading release notes as a security changelog: this project ships fixes first and advisories weeks later, in bulk. Check github.com/openclaw/openclaw/security/advisories directly.

Update 2026-09-24 — the vendor names the source of the batch: a Trail of Bits audit under OpenAI's Patch the Planet (27 advisories, 2 High), all fixed in 2026.8.1 and the 2026.7.33 LTS; plus a low-severity canvas DoS still open in 2026.9.5

OpenClaw's blog post of 2026-09-21, "OpenClaw Completes Security Audit Through OpenAI's Patch the Planet Initiative," explains where the 09-11 bulk publication came from: Trail of Bits, working with Codex-assisted workflows under OpenAI's open-source patching programme, "submitted 27 private repository advisories and 3 standalone hardening pull requests"; 24 of the 27 carried severity ratings — 0 Critical, 2 High, 16 Medium, 6 Low — 23 were confirmed, one had been fixed before submission, and the other three were defense-in-depth findings with no rating "because they did not cross a documented trust boundary." The two Highs are the two already at the top of this file: exec approvals reusable in a working directory nobody reviewed (GHSA-3mq7-q27j-mq7q) and the WhatsApp login tool reachable from non-owner turns (GHSA-9m4p-cqp4-jppq). The vendor's own summary of the dominant bug class — "losing permissions between steps," where "a request might enter OpenClaw with limited access, then start another piece of work that no longer carried those limits" — is the authorization-inheritance failure this file's TL;DR describes from the outside. Fix status per the vendor: every issue "repaired on main and … shipped in the 2026.8.1 and 2026.7.33 LTS stable releases." That is the first statement naming the LTS line as also fixed; the upgrade guidance above now reads "≥ 2026.8.1, or ≥ 2026.7.33 on the LTS train."

Separately, the advisory database's openclaw query shows CVE-2026-94094 (GHSA-24pq-v99h-hj63, VulDB-sourced, published 2026-09-21, CVSS 4.0 2.1 Low): the canvas extension's host route (createCanvasHostHandler in extensions/canvas/src/host/server.ts) buffers whole files with readFile() — a remote, low-privilege denial of service — and the record states the suggested streaming/size-limit fix "was never shipped — latest 2026.9.5 still buffers the whole file." Low impact, noted here so the next sweep does not re-triage it.

Update 2026-09-26 — VulnCheck assigns 77 CVEs to the batch overnight (CVE-2026-100525 … CVE-2026-100604), including a 9.0 for the iOS app and five for the ClawHub registry backend; several fixes land after 2026.8.1, so the upgrade target is now ≥ 2026.9.3 (iOS ≥ 2026.8.11)

Fifteen days after the 75-advisory dump, the CVE wave arrived: an NVD query for openclaw published 2026-09-24 → 09-26 returns 77 records, all published 2026-09-26, all with CNA disclosure@vulncheck.com, numbered contiguously CVE-2026-100525 through CVE-2026-100604 (two numbers in the range are not OpenClaw's). Each carries a CVSS 4.0 score VulnCheck assigned; the vendor advisories carried only a severity word plus, in some cases, a CVSS 3.1 number, and the two disagree in the usual direction — the Claude-permission-prompt bug the 09-14 walk singled out (GHSA-p5g8-m35v-7m82, vendor High / 8.0) is CVE-2026-100585, VulnCheck 8.6 ("an authorized non-owner channel sender with channel command access can approve or deny a pending permission request intended for the owner"). The advisory database mirrors each CVE as a second entry beside the vendor advisory (e.g. GHSA-87g7-76gr-73g8 for the same bug), so a GHSA grep will find two ids per issue from now on — grep the CVE.

What the scores add, ranked by VulnCheck's number:

Fix versions past 2026.8.1 (the number this file has been recommending): CVE-2026-100527 (browser-relay DoS) is fixed in 2026.8.2; CVE-2026-100546 (a Discord race) affects ≥ 2026.7.2 and is fixed in 2026.9.2; CVE-2026-100525 (@openclaw/diagnostics-prometheus) and CVE-2026-100526 (@openclaw/discord) are fixed in 2026.9.3; the two iOS CVEs (100551, 100581 — cleartext gateway credentials in App Group UserDefaults) are fixed in iOS 2026.8.11. Registry check 2026-09-14 already showed 2026.9.4 as latest, so a routine upgrade covers all of them; a pinned 2026.8.1 does not. The ClawHub backend CVEs have no version field — they describe the hosted registry, which the project operates, so there is nothing for a user to upgrade but there is something to know: the skill-report/moderation path this corpus relies on when a malicious skill is reported (ClawHavoc) had authorization holes of its own.

Status stays patched; severity stays high (one 9.0 in a client app whose gateway-impersonation impact depends on the attacker being on-path, not the 9.x-unauthenticated-RCE shape this repo reserves critical for). The "am I affected" step is unchanged, with the target version raised: openclaw --version ≥ 2026.9.3, iOS app ≥ 2026.8.11, and audit non-owner channel activity for the window before your upgrade.

Update 2026-09-30 — two more VulnCheck CVEs (2026-09-29) for bugs fixed in 2026.9.4 and 2026.9.5: read-scoped operators could redeem an mcp.app.view ticket to run write-scoped MCP App tools (CVE-2026-102807, 6.0), and the Gateway's local media root allowlist let a sandboxed session read files from sibling session sandboxes (CVE-2026-102806, 6.0); target is now ≥ 2026.9.5, npm latest 2026.9.7

CVE-2026-102807 (CVSS 4.0 6.0, published 2026-09-29): "OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can obtain a standalone ticket from mcp.app.view and redeem it at the MCP app view endpoint to invoke state-changing tools without proper authorization checks." Fixed in the 2026.9.4 release. CVE-2026-102806 (CVSS 4.0 6.0, published 2026-09-29): "OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared workspace directories through media pipeline functions that fail to restrict reads to the active session." Fixed in 2026.9.5. Neither appears on the vendor's advisory tab (first page checked 2026-09-30, newest entries still 2026-09-11); both reference the docs.openclaw.ai release notes and specific source lines. npm shows 2026.9.6 (2026-09-23), 2026.8.33 (09-28) and 2026.9.7 (2026-09-30) as the newest releases, so the practical target is the latest stable. The 2026-09-26 upgrade advice above (≥ 2026.9.3) is superseded: ≥ 2026.9.5.

Update 2026-10-01 — the Windows Node is a separate product with its own advisory tab: four VulnCheck CVEs (2026-09-30) for bugs fixed in v2026.7.1-3 (2026-09-03) — exec-approval bypass via pipes and command substitution (CVE-2026-101880, 8.7), env-variable sanitizer that missed GIT_CONFIG_* / DOTNET_STARTUP_HOOKS / JAVA_TOOL_OPTIONS (CVE-2026-101884, 7.7), screen/camera/location capture without consent (CVE-2026-101879, 7.1) and a canvas SSRF still present through 2026.9.4 (CVE-2026-101883, 5.3)

openclaw/openclaw-windows-node ("OpenClaw Windows Hub", the tray app that gives the Gateway a Windows execution node) publishes its advisories on its own repository's security tab, which the OpenClaw walk above never covered. VulnCheck assigned CVEs on 2026-09-30 to three vendor advisories dated 2026-09-03 plus one newer finding; NVD and the vendor pages:

• CVE-2026-101880 / GHSA-r3x2-vf2f-vvj8 (and GHSA-vg38-vjq2-vgvh) — CVSS 4.0 8.7 (vendor 3.1 8.8): the system.run exec-approval parser "fails to split commands on pipe operators or extract command substitutions," so a connected gateway or agent places a denied command behind an allowed prefix (allowed | denied, $(denied)) and it runs. Fixed v2026.7.1-3.
• CVE-2026-101884 / GHSA-39cf-qcfw-g8pg — 7.7 (vendor 8.8): the env-override sanitizer for system.run was a denylist that omitted GIT_CONFIG_*, DOTNET_STARTUP_HOOKS and JAVA_TOOL_OPTIONS, so an allowlisted git, dotnet or java could be driven to load attacker code — the GitSpawn class reached through environment variables. Fixed v2026.7.1-3.
• CVE-2026-101879 / GHSA-fxch-cgcp-4v5h — 7.1 (vendor 7.5): the instantaneous capture handlers screen.snapshot, camera.snap and location.get skipped the per-use consent their recording siblings enforce, so a gateway — or a prompt-injected agent — could silently screenshot, photograph the user through the webcam and read device location. Fixed v2026.7.1-3 (the release notes' only hint is "Fix camera/screen capture consent hang for unattended MCP callers").
• CVE-2026-101883 / GHSA-7vch-pmw9-3g4q — 5.3: canvas.present bypasses the URL risk evaluation that canvas.navigate enforces, so the node's WebView can be pointed at localhost, private-network or tailnet services. Affects through 2026.9.4; no fixed version is stated in the NVD record.

Takeaway for the per-product walk: an agent framework's companion apps (Windows node, iOS app — see the 09-26 update — browser extension) each have their own tab and their own release train. For readers: a Windows machine running the OpenClaw node below v2026.7.1-3 gave any connected gateway shell on the box with no approval that could not be bypassed, and silent webcam/screen capture; update the node, not only the Gateway, and review which gateways are paired.

Update 2026-10-06 — a 76th advisory from the same 09-11 batch surfaces on the database's agent listing: explicit read targets in the Microsoft Teams, Feishu, Matrix and Google Chat channel plugins skipped the operator's read allowlist (GHSA-g7fw-3gjp-g5hf, 6.5; @openclaw/feishu, googlechat, matrix, msteams < 2026.8.1)

The database reviewed GHSA-g7fw-3gjp-g5hf on 2026-10-05; the vendor published it on 2026-09-11 with the rest of the batch, and it was not in this file's count. "Explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat [could] reach channels or rooms outside the configured read policy," so a lower-privileged user with channel-read access retrieved content the operator's allowlist was meant to exclude. CVSS 6.5 (PR:L, confidentiality only); affected < 2026.8.1 for all four plugins, fixed in 2026.8.1 (PR openclaw/openclaw#99905, commit fbd330b7); interim mitigations per the vendor: disable explicit-target read actions or restrict the bot account at the platform. Reporter qc9c. No CVE. It fits the batch's pattern (an authorization check applied to one code path and not its sibling) and changes nothing in the upgrade target — ≥ 2026.9.5 already covers it. The operational note is that the channel plugins are versioned with the core and must be upgraded with it; a 2026.8.1 gateway with an older @openclaw/msteams left in node_modules is still exposed.

Sources

• 2026-09-30 update sources — NVD API — CVE-2026-102807 and CVE-2026-102806 (VulnCheck CNA, 2026-09-29, CVSS 4.0 6.0 each, descriptions quoted, references to the 2026.9.4 / 2026.9.5 release notes and source lines), GitHub Advisory Database — CVE-2026-102807 (GHSA-3xrq-g42v-gh57) and CVE-2026-102806 (GHSA-8f5c-296x-75hm) (unreviewed mirrors, Moderate), openclaw/openclaw advisories index (first page, newest 2026-09-11), npm openclaw release metadata (2026.9.7 on 2026-09-30). All fetched 2026-09-30.
• OpenClaw — Security Advisories index — walked directly 2026-09-14, pages 1–11: 75 advisories dated 2026-09-11 (30 High / 40 Moderate / 5 Low by the index's own labels), ~30 dated 2026-06-30, three dated 2026-05-28; page 12 and beyond not walked.
• Individual vendor advisory pages, fetched 2026-09-14: GHSA-wwx7-573h-pqwc, GHSA-7cp7-87pj-p32v, GHSA-9m4p-cqp4-jppq, GHSA-5mrc-77hj-xjxv, GHSA-crg9-c62w-j2p5, GHSA-qgj5-6x35-9g6f, GHSA-62qm-6fjj-6g23, GHSA-hgv5-f2r3-6v9r, GHSA-3mq7-q27j-mq7q, GHSA-jhfx-v2j8-x3m6 — CVSS scores, affected/patched ranges, descriptions, interim mitigations.
• OpenClaw — release 2026.8.1 — fetched 2026-09-14: released 2026-08-31; hardening notes, no vulnerability list.
• npm registry — openclaw package metadata — queried 2026-09-14 (npm view openclaw time): 2026.8.1 published 2026-08-31, 2026.9.4 (latest) 2026-09-11.

2026-09-23 update sources — all fetched 2026-09-23: - GitHub Advisory Database — GHSA-wjj6-g7c3-q75f (CVE-2026-95815), openclaw/openclaw — GHSA-5j57-84cx-r295, VulnCheck advisory and NVD API — CVE-2026-95815 — CNA VulnCheck, published 2026-09-22, CVSS 4.0 7.2 / 3.1 6.3, CWE-532, before 2026.8.11 → fixed 2026.8.11, commit 8361f37, credit Jason O'Neal. - Single-source note: every fact above comes from the vendor's own advisory pages; no independent researcher write-up or press coverage was found for this batch as of 2026-09-14. Status is patched because the vendor states patched versions for every sampled advisory. - 2026-09-24 update sources — OpenClaw — OpenClaw Completes Security Audit Through OpenAI's Patch the Planet Initiative (vendor, 2026-09-21: the 27/3 counts, the 0/2/16/6 severity split, the permission-loss finding, the 2026.8.1 and 2026.7.33 LTS fix statement). Fetched 2026-09-24. GitHub Advisory Database — GHSA-24pq-v99h-hj63 (CVE-2026-94094) (fetched 2026-09-24: canvas host DoS, CVSS 2.1, "never shipped" note, affected through 2026.9.5).

2026-09-26 update sources — all fetched 2026-09-26: - NVD API — CVEs matching openclaw, published 2026-09-24 → 09-26 — 77 results, CNA disclosure@vulncheck.com, the CVSS 4.0 scores, affected/fixed ranges and descriptions tabulated above. - VulnCheck — OpenClaw before 2026.7.1 authentication bypass via MCP channel (CVE-2026-100585) — the CNA record: 8.6, CWE-862, fixed 2026.7.1, credit whyiug, reference to the vendor advisory. - openclaw/openclaw — GHSA-p5g8-m35v-7m82, "Claude permission replies could omit owner authorization" — the vendor advisory for the same bug: High / CVSS 8.0, published 2026-09-11, "no known CVE" still shown on the page at fetch time. - GitHub Advisory Database — GHSA-87g7-76gr-73g8 (CVE-2026-100585) — the database's CVE-sourced mirror entry, published 2026-09-26, showing the two-ids-per-bug shape; the mcp, claude and agent recency listings each carried 20+ of the wave on 2026-09-26. - 2026-10-01 update sources — NVD API — CVE-2026-101880, CVE-2026-101884, CVE-2026-101879, CVE-2026-101883 (CNA VulnCheck, published 2026-09-30; descriptions and CVSS 4.0 scores quoted; queried 2026-10-01); vendor advisories GHSA-r3x2-vf2f-vvj8, GHSA-39cf-qcfw-g8pg, GHSA-fxch-cgcp-4v5h (all published 2026-09-03, High, patched v2026.7.1-3, CWE-184/863/306/862; fetched 2026-10-01); openclaw-windows-node — release v2026.7.1-3 (released 2026-09-03; the consent-hang note; fetched 2026-10-01); GitHub Advisory Database — agent, sorted by published date (the four unreviewed 09-30 entries; fetched 2026-10-01). - GHSA-g7fw-3gjp-g5hf — OpenClaw: Channel read actions could skip target allowlists — fetched 2026-10-06: 6.5, the four packages < 2026.8.1 → 2026.8.1, the description quoted, PR #99905, commit fbd330b7, reporter qc9c, vendor date 2026-09-11, reviewed 2026-10-05. - GitHub Advisory Database — agent recency listing — fetched 2026-10-06: the Oct 5 row.