Sign in
Deutsch English Español Polski
Medium

OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

  • Disclosed: 17.04.2026
  • Updated: 11.10.2026 10:22

Summary

Webchat tool-result media normalization could pass local and UNC-style file paths into the host-side media embedding path without applying the configured local-root containment policy.

Impact

A crafted tool-result media reference could cause the host to attempt local file reads or Windows UNC/network path access while preparing webchat media blocks. This could disclose allowed host files or trigger network credential exposure on affected Windows deployments. Severity remains medium because exploitation depends on a tool-result media path reaching the webchat embedding path, but the sink is a host-side file read before the user sees the rendered result.

Affected versions

  • Affected: >= 2026.4.7, < 2026.4.15
  • Patched: 2026.4.15

Fix

OpenClaw 2026.4.15 hardens the webchat media path and the shared media resolver. Remote-host file:// URLs and Windows network paths are rejected before filesystem access, and audio embedding now enforces configured localRoots containment before stat or read operations.

Verified in v2026.4.15:

  • src/gateway/server-methods/chat-webchat-media.ts uses safe file-URL parsing, rejects Windows network paths, and calls assertLocalMediaAllowed before probing local audio files.
  • src/media/web-media.ts rejects remote-host file:// URLs, Windows network paths, and local-root bypasses on the shared media path.
  • src/gateway/server-methods/chat-webchat-media.test.ts covers both remote-host file:// rejection and local-root denial before filesystem access.

Fix commits included in v2026.4.15 and absent from v2026.4.14:

  • 1470de5d3e0970856d86cd99336bb8ada3fe87da via PR #67293
  • 6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde via PR #67298
  • 52ef42302ead9e183e6c8810e0a04ee4ef8ae9fc via PR #67303 as defense-in-depth for trusted media passthrough anchoring

Thanks to @Kherrisan for reporting this issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package openclaw >= 2026.4.7, < 2026.4.15 2026.4.15

References

CVSS score 5.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness (CWE)
CWE-22, CWE-73
Platform
npm
Package
openclaw
Disclosed
17.04.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mr34-9552-qr95 - CC BY 4.0

Vulnerability history: openclaw

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (588) in the archive
Total entries
588
First → latest
02.2026 07.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 20
  • High 215
  • Medium 299
  • Low 54

Disclosures per year

Severity:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    High CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    High · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    High CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    High CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    High · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    High · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    High · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    High · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    High · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    High · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    High · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Critical CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    High · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    High CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    High · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    High · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    High · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    High · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    High · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    High · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    High · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    High · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    High CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    High · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    High · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    High · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    High · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    High · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    High · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    High · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    High · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    High · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    High · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    High · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    High · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    High · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    High · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    High · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Workspace dotenv could override runtime-control environment variables
    High · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  42. OpenClaw: Webchat media embedding enforces local-root containment for tool-result files this entry
    Medium · 5.8 CVE-2026-41389 >= 2026.4.7, < 2026.4.15 2026.4.15
  43. OpenClaw: Feishu webhook and card-action validation now fail closed
    Critical · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  44. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Critical · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  45. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    High CVE-2026-43533 < 2026.4.10 2026.4.10
  46. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    High · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  47. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    High · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  48. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    High · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  49. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    High · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  50. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    High CVE-2026-43581 < 2026.4.10 2026.4.10
  51. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    High · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  52. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    High · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  53. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    High · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  54. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    High CVE-2026-43528 < 2026.4.14 2026.4.14
  55. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    High CVE-2026-40037 < 2026.4.8 2026.4.8
  56. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    High · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  57. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    High CVE-2026-42427 < 2026.4.8 2026.4.8
  58. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    High ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  59. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    High ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  60. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    High · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  61. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    High · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  62. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    High CVE-2026-34511 < 2026.4.2 2026.4.2
  63. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    High CVE-2026-41393 < 2026.3.31 2026.3.31
  64. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    High · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  65. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    High CVE-2026-41353 < 2026.3.22 2026.3.22
  66. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    High · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  67. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Critical · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  68. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    High · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  69. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    High CVE-2026-41404 < 2026.3.31 2026.3.31
  70. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    High CVE-2026-41349 < 2026.3.28 2026.3.28
  71. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    High · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  72. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    High · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  73. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    High · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  74. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    High CVE-2026-41366 < 2026.3.31 2026.3.31
  75. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    High · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  76. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    High · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  77. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    High · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  78. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    High · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  79. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Critical CVE-2026-41329 < 2026.3.31 2026.3.31
  80. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    High · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  81. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Critical · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
  82. OpenClaw gateway exec allow-always over-trusts positional carrier executables
    High · 7.3 CVE-2026-41380 < 2026.3.28 2026.3.28
  83. OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`
    High CVE-2026-41371 < 2026.3.28 2026.3.28
  84. OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper
    High · 7.3 CVE-2026-41390 < 2026.3.28 2026.3.28
  85. OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
    High · 9.6 CVE-2026-41387 < 2026.3.22 2026.3.22
  86. OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing
    High CVE-2026-41299 < 2026.3.28 2026.3.28
  87. OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
    High · 7.7 CVE-2026-41368 < 2026.3.28 2026.3.28
  88. OpenClaw's message tool media parameter bypasses tool policy filesystem isolation
    High · 6.2 CVE-2026-33581 < 2026.3.24 2026.3.24
  89. OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals
    High · 8.8 CVE-2026-41303 < 2026.3.28 2026.3.28
  90. OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
    High · 7.5 CVE-2026-34503 < 2026.3.28 2026.3.28
  91. OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
    High · 7.3 CVE-2026-41342 < 2026.3.28 2026.3.28
  92. OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation
    Critical CVE-2026-33579 < 2026.3.28 2026.3.28
  93. OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
    High CVE-2026-41395 < 2026.3.28 2026.3.28
  94. OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
    High · 8.1 CVE-2026-35653 < 2026.3.24 2026.3.24
  95. OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
    High CVE-2026-35621 < 2026.3.24 2026.3.24
  96. OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
    High · 8.6 CVE-2026-35641 < 2026.3.24 2026.3.24
  97. OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
    High · 7.7 CVE-2026-35668 < 2026.3.24 2026.3.24
  98. OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
    High CVE-2026-35629 < 2026.3.28 2026.3.28
  99. OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
    High CVE-2026-35636 >= 2026.3.11, < 2026.3.28 2026.3.28
  100. OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
    High CVE-2026-35669 <= 2026.3.24 no fix
Show more (20) Showing 100 of 236

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.