Description
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-26
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the Scheme Handler’s assertBrowserNavigationAllowed function within src/browser/navigation-guard.ts. By supplying a crafted url argument, an attacker can cause the function to reveal internal data that should remain confidential. The vulnerability enables information disclosure, linked to CWE-200 and CWE-284.

Affected Systems

All releases of the MF‑YANG openclaw‑cn application up to version 0.2.1 are affected. No later releases in the CNA data mention a fix, meaning systems still running those versions are at risk. The vulnerable component is the Scheme Handler, part of the openclaw‑cn codebase.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood that attackers will exploit it in the near term. The flaw is not listed in CISA’s KEV catalog. An attacker can exploit the weakness remotely by sending crafted URLs to the Scheme Handler, potentially gaining visibility into protected data. Because no patch is currently available, the risk remains high for publicly exposed instances of the navigation guard.

Generated by OpenCVE AI on August 3, 2026 at 18:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade openclaw‑cn to a version that resolves the assertBrowserNavigationAllowed flaw, if such a release exists.
  • If no update is available, limit external access to the navigation guard by configuring firewalls or reverse proxies to allow internal clients only.
  • Implement input validation for the url parameter to permit only trusted schemes and hosts, thereby blocking malformed requests that trigger the disclosure.
  • Monitor request logs for suspicious navigation attempts and investigate any anomalies.

Generated by OpenCVE AI on August 3, 2026 at 18:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 26 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure
First Time appeared Mf-yang
Mf-yang openclaw-cn
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*
Vendors & Products Mf-yang
Mf-yang openclaw-cn
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mf-yang Openclaw-cn
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-27T13:18:59.011Z

Reserved: 2026-07-25T18:54:27.603Z

Link: CVE-2026-17457

cve-icon Vulnrichment

Updated: 2026-07-27T13:18:55.098Z

cve-icon NVD

Status : Deferred

Published: 2026-07-26T10:16:25.163

Modified: 2026-07-27T20:25:13.817

Link: CVE-2026-17457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T18:30:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control