Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-9f72-qcpw-2hxc
Advisory ID github_osv/GHSA-9f72-qcpw-2hxc
Aliases
Summary OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs ### Summary In sandboxed runs, native prompt image auto-load did not honor `tools.fs.workspaceOnly=true`. This optional hardening setting is **not enabled by default**. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example `/agent/secret.png`) and load those image bytes for vision-capable model input. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version at triage time: `2026.2.23` - Vulnerable version range: `<= 2026.2.23` - Patched version (planned next release): `2026.2.24` ### Conditions Required This issue required all of the following: - sandbox mode enabled, - `tools.fs.workspaceOnly=true` configured, - an out-of-workspace mount path reachable from the sandbox (for example `/agent`), - vision-capable model path active for native prompt image loading. ### Technical Details Native prompt image ingestion (`detectAndLoadPromptImages` / `loadImageFromRef`) resolved and read sandbox paths but did not apply the same workspace-root assertion used by file tools when `tools.fs.workspaceOnly` was set. ### Fix Commit(s) - `370d115549c0dadace0902775eea0d5094aedfdc` ### Verification - `pnpm check` - `pnpm exec vitest run --config vitest.gateway.config.ts` - `pnpm test:fast` ### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.24`) so once npm release is available, this advisory only needs publish action. OpenClaw thanks @tdjackey for reporting. ### Publication Update (2026-02-25) `openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-284 Improper Access Control
System Score Found at
cvssv4 8.9 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9f72-qcpw-2hxc/GHSA-9f72-qcpw-2hxc.json
generic_textual HIGH
Reference id Reference type URL
https://github.com/openclaw/openclaw
https://github.com/openclaw/openclaw/commit/370d115549c0dadace0902775eea0d5094aedfdc
https://github.com/openclaw/openclaw/security/advisories/GHSA-9f72-qcpw-2hxc
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9f72-qcpw-2hxc/GHSA-9f72-qcpw-2hxc.json
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.