GHSA-77w2-crqv-cmv3Medium

OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

Published
March 29, 2026
Last Modified
April 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-35664 →

📋 Description

Summary

Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

Feishu raw card sends could previously mint legacy callback payloads that bypassed DM pairing and let unpaired recipients reach callback handling. Commit 81c45976db532324b5a0918a70decc19520dc354 rejects legacy raw-card command payloads so callbacks stay on the normal paired path.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 81c45976db532324b5a0918a70decc19520dc354.

Fix Commit(s)

  • 81c45976db532324b5a0918a70decc19520dc354

🎯 Affected products1

  • npm/openclaw:<= 2026.3.24

🔗 References (3)