Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-35643
8.8 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface
OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.
References
-
GitHub Security Advisory (GHSA-cxmw-p77q-wchg) third-party-advisory
-
Patch Commit #1 patch
-
Patch Commit #2 patch
Affected products
OpenClaw
- <2026.3.22
- ==2026.3.22
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@chrisportela Chris Portela <chris@chrisportela.com>