Skip to content

v0.4.1

Choose a tag to compare

View all tags
@thebenignhacker thebenignhacker released this 06 Feb 06:15
· 1214 commits to main since this release
v0.4.1
ac5aff1

What's New — v0.4.0 → v0.4.1

CVE-2026-25253 Detection (v0.4.0)

First scanner for CVE-2026-25253 (CVSS 8.8) — the OpenClaw WebSocket hijacking RCE.

  • CVE-001: Detect vulnerable OpenClaw versions (before v2026.1.29)
  • CVE-002: Missing controlUi.allowedOrigins (patch alone isn't enough)
  • SUPPLY-005–008: ClawHavoc campaign IOCs (C2 IPs, malware filenames, ClickFix patterns)
  • GATEWAY-007–008, CONFIG-007–009: Config hardening (open DM wildcards, disabled sandbox, weak tokens)

11 new checks. 145+ total.

v0.4.1

  • Updated README with accurate check counts and full 31-category table
  • Synced README to npm package page

Quick Start

npx hackmyagent@latest secure .
npx hackmyagent@latest secure-openclaw

No account required. Runs locally. Apache-2.0.

Assets 2
Loading