Snyk Security Database

@openclaw/synology-chat is a Synology Chat channel plugin for OpenClaw

Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the webhook-handler process. An attacker can redirect message replies to an unintended user by exploiting mutable username resolution instead of relying on a stable user identifier.

streamlit is a The fastest way to build data apps in Python

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper validation of filesystem paths in the ComponentRequestHandler process. An attacker can trigger outbound SMB authentication attempts from the server, potentially exposing NTLMv2 credential hashes of the Windows user running the process, by supplying a malicious UNC path in a request.

Note:

This is only exploitable if the application is running on a Windows host and component endpoints are exposed to untrusted networks.

Affected versions of this package are vulnerable to Directory Traversal via the extract function in Unzip.java. An attacker can write arbitrary files outside the intended extraction directory by crafting zip archives with specially crafted entry names containing directory traversal sequences.