From 9e7aab9baf799b44f569dba30af446f877d7bd63 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sat, 14 Feb 2026 22:53:42 +0100 Subject: [PATCH] docs(changelog): credit logicx24 for plugin install traversal report --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5ac331cbe..650d30a43 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -567,7 +567,7 @@ Docs: https://docs.openclaw.ai - Security: guard remote media fetches with SSRF protections (block private/localhost, DNS pinning). - Updates: clean stale global install rename dirs and extend gateway update timeouts to avoid npm ENOTEMPTY failures. -- Plugins: validate plugin/hook install paths and reject traversal-like names. +- Security/Plugins/Hooks: validate install paths and reject traversal-like names (prevents path traversal outside the state dir). Thanks @logicx24. - Telegram: add download timeouts for file fetches. (#6914) Thanks @hclsys. - Telegram: enforce thread specs for DM vs forum sends. (#6833) Thanks @obviyus. - Streaming: flush block streaming on paragraph boundaries for newline chunking. (#7014)