We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-53851

CVE-2026-53851

React

Severity: MEDIUM
CVSS: 5.3CVSS
Published: 2026-06-16
Last modified: 2026-06-16
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-862

Description

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8
https://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass

Summary

Description

References