GHSA-v773-r54f-q32w: OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands

February 18, 2026

When Slack DMs are configured with dmPolicy=open, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions.

References

github.com/advisories/GHSA-v773-r54f-q32w
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/f19eabee54c49e9a2e264b4965edf28a2f92e657
github.com/openclaw/openclaw/releases/tag/v2026.2.14
github.com/openclaw/openclaw/security/advisories/GHSA-v773-r54f-q32w

Code Behaviors & Features

Detect and mitigate GHSA-v773-r54f-q32w with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →