Advisory details:
github_osv / GHSA-w5c7-9qqw-6645
| Advisory ID | github_osv/GHSA-w5c7-9qqw-6645 |
| Aliases | |
| Summary | OpenClaw inter-session prompts could be treated as direct user instructions ## Summary Inter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: "user"` without provenance metadata. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.12` (i.e. `< 2026.2.13`) - Fixed in: `2026.2.13` (patched versions `>= 2026.2.13`) ## Impact A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input. This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust `role: "user"` as a sole authority signal. ## Technical details Before the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker. As a result, downstream workers and transcript readers could not distinguish: - External user input - Internal inter-session routed input ## Fix OpenClaw now carries explicit input provenance end-to-end for routed prompts. Key changes: - Added structured provenance model (`inputProvenance`) with `kind` values including `inter_session`. - `sessions_send` and agent-to-agent steps now set inter-session provenance when invoking target runs. - Provenance is persisted on user messages as `message.provenance.kind = "inter_session"` (role remains `user` for provider compatibility). - Transcript readers and memory helpers were updated to respect provenance and avoid treating inter-session prompts as external user-originated input. - Runtime context rebuilding now annotates inter-session turns with an explicit in-memory marker (`[Inter-session message]`) for clearer model-side disambiguation. - Regression tests were added for transcript parsing, session tools flow, runner sanitization, and memory hook behavior. ## Fix Commit(s) - `85409e401b6586f83954cb53552395d7aab04797` ## Workarounds If immediate upgrade is not possible: - Disable or restrict `sessions_send` in affected environments. - Do not use role alone as an authority boundary; require provenance-aware checks in orchestration logic. ## Credit Reported by @anbecker. Thanks @anbecker for reporting. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.4 |
| Risk | 3.2 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 7.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w5c7-9qqw-6645/GHSA-w5c7-9qqw-6645.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
There are no SSVC decisions available.