Request CVE assignment for published GHSA-9c3v-684m-579c (openclaw)

[dingliweixlm-byte]

Hi GitHub Security Team,

I am the original security researcher who reported the vulnerability documented in GHSA-9c3v-684m-579c.

Advisory Link: GHSA-9c3v-684m-579c

The vendor (OpenClaw) has officially accepted the vulnerability, patched it (version < 2026.6.5), and published this repository-level advisory today. However, they did not request a CVE ID during the publication process.

Since this is a publicly disclosed, confirmed architectural security flaw affecting the npm ecosystem, I am requesting that the GitHub CNA team review this advisory, promote it to the Global Advisory Database, and assign an official CVE ID so that it can be properly tracked by the community and downstream enterprise users.

Thank you!

[taladrane]

👋 Thank you for your report, but unfortunately github/advisory-database is not a venue for requesting CVE assignments. This repository's purpose is to curate and publish advisory records for vulnerabilities that already have a public identifier (such as a CVE or GHSA), so ecosystems and tooling can consume consistent metadata. Per our contributing guidelines, this repository is not the right place for reporting new vulnerabilities, coordinating disclosure, or escalating cases where a maintainer or vendor is unresponsive.

We recommend reaching out to a Root CNA like MITRE via the CVE Request form for a CVE assignment.

Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!