GHSA-rm2p-j3r7-4x4j: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

March 3, 2026

OpenClaw Slack monitor handled reaction_* and pin_* non-message events before applying sender-policy checks consistently.

In affected versions, these events could be added to system-event context even when sender policy would not normally allow them.

References

github.com/advisories/GHSA-rm2p-j3r7-4x4j
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/75dfb71e4e8b7c2feba5a8ca662f92ea840e0147
github.com/openclaw/openclaw/commit/aedf62ac7e669a89c7b299201bf6537dc6b12e0e
github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j

Code Behaviors & Features

Detect and mitigate GHSA-rm2p-j3r7-4x4j with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →