GitHub Advisoryadvisory · npm

GHSA-9f72-qcpw-2hxc OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

HIGH Published 2026-03-03 Modified 2026-03-03 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Weaknesses
CWE-200, CWE-284
Reviewed
2026-03-03

Affected packages

• npm openclaw: < 2026.2.24 → fixed in 2026.2.24

Description

Summary In sandboxed runs, native prompt image auto-load did not honor `tools.fs.workspaceOnly=true`. This optional hardening setting is not enabled by default. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example `/agent/secret.png`) and load those image bytes for vision-capable model input. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version at triage time: `2026.2.23` • Vulnerable version range: `= 2026.2.24` as patched.

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-284 Improper Access Control weakness

References