GHSA-3xv9-89fm-7h4r: OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

April 3, 2026 (updated April 9, 2026)

diffs viewer misclassifies proxied remote requests as loopback when allowRemoteViewer is disabled

References

github.com/advisories/GHSA-3xv9-89fm-7h4r
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828a002c
github.com/openclaw/openclaw/releases/tag/v2026.3.31
github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r

Code Behaviors & Features

Detect and mitigate GHSA-3xv9-89fm-7h4r with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →