Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix npm-shrinkwrap.json vendors vulnerable [email protected] (GHSA-q8mj-m7cp-5q26)

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Starting with [email protected] (and confirmed in 2026.5.24-beta.1 / 2026.5.24-beta.2), the published npm package ships npm-shrinkwrap.json that vendors [email protected] under node_modules/openclaw/node_modules/qs.

This version of qs has a known moderate DoS vulnerability:

  • Advisory: GHSA-q8mj-m7cp-5q26
  • Severity: Moderate
  • Vector: qs.stringify crashes with TypeError on null/undefined entries in arrayFormat: 'comma' arrays when encodeValuesOnly is set
  • Fixed in: [email protected]

Root Cause

Because npm-shrinkwrap.json is authoritative for the subtree, consumers cannot override this dependency:

Fix Action

Fix / Workaround

  • package.json overrides field is ignored for vendored deps
  • npm audit fix cannot patch it
  • npm audit --omit=dev flags it on every install

Code Example

mkdir /tmp/test-qs && cd /tmp/test-qs
npm init -y
npm install openclaw@2026.5.22
npm audit --omit=dev
# Reports: GHSA-q8mj-m7cp-5q26 moderate in qs@6.14.2
npm ls qs
# Shows: node_modules/openclaw/node_modules/qs@6.14.2
RAW_BUFFERClick to expand / collapse

Summary

Starting with [email protected] (and confirmed in 2026.5.24-beta.1 / 2026.5.24-beta.2), the published npm package ships npm-shrinkwrap.json that vendors [email protected] under node_modules/openclaw/node_modules/qs.

This version of qs has a known moderate DoS vulnerability:

  • Advisory: GHSA-q8mj-m7cp-5q26
  • Severity: Moderate
  • Vector: qs.stringify crashes with TypeError on null/undefined entries in arrayFormat: 'comma' arrays when encodeValuesOnly is set
  • Fixed in: [email protected]

Impact on consumers

Because npm-shrinkwrap.json is authoritative for the subtree, consumers cannot override this dependency:

  • package.json overrides field is ignored for vendored deps
  • npm audit fix cannot patch it
  • npm audit --omit=dev flags it on every install

This means any project that depends on openclaw inherits a perpetual moderate vulnerability finding that cannot be resolved without:

  1. Forking openclaw (undesirable)
  2. Post-install hacking the shrinkwrap (fragile, breaks reproducibility)
  3. Waiting for an upstream fix (this issue)

Reproduction

mkdir /tmp/test-qs && cd /tmp/test-qs
npm init -y
npm install [email protected]
npm audit --omit=dev
# Reports: GHSA-q8mj-m7cp-5q26 moderate in [email protected]
npm ls qs
# Shows: node_modules/openclaw/node_modules/[email protected]

Requested fix

Bump qs to >=6.15.2 in openclaw's dependency tree and regenerate npm-shrinkwrap.json before the next stable release.

Context

We discovered this while upgrading from [email protected] to 2026.5.22 to resolve a separate HIGH-severity [email protected] vulnerability chain (which the upgrade successfully eliminated). Details: https://github.com/cloudwalk/dr-watson/issues/120

Thank you for maintaining openclaw! 🙏

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING