Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / npm/openclaw/GHSA-gfg9-5357-hv4c
Advisory ID gitlab/npm/openclaw/GHSA-gfg9-5357-hv4c
Aliases GHSA-gfg9-5357-hv4c
Summary OpenClaw: Webchat audio embedding could read local files without local-root containment OpenClaw deployments before `2026.4.15` could embed host-local audio files into webchat responses without applying the local media root containment check used by other media-serving paths. If an attacker could influence an agent or tool-produced `ReplyPayload.mediaUrl`, the webchat audio embedding helper could resolve an absolute local path or `file:` URL, read an audio-like file under the size cap, and base64-encode it into the webchat media response. This crossed the model/tool-output boundary into a host file read. Prompt injection or malicious tool output is a delivery mechanism; the security boundary failure is the missing local-root containment check. The impact is narrow: the file had to be readable by the gateway process, have an audio-like extension, and fit within the webchat audio size cap. The issue exposed contents into the webchat assistant/media transcript path; it was not a general remote filesystem API.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/GHSA-gfg9-5357-hv4c.yml
Reference id Reference type URL
6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde Other https://github.com/openclaw/openclaw/commit/6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde
GHSA-gfg9-5357-hv4c https://github.com/advisories/GHSA-gfg9-5357-hv4c
GHSA-gfg9-5357-hv4c Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-gfg9-5357-hv4c
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/GHSA-gfg9-5357-hv4c.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.