GHSA-9mph-4f7v-fmvh OpenClaw has agent avatar symlink traversal in gateway session metadata

• npm openclaw: < 2026.2.22 → fixed in 2026.2.22

Summary A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 `data:` URL in gateway responses. Impact • Confidentiality impact: local file read in the gateway process context. • Exfiltration path: `agents.list` can return the resulting `avatarUrl` payload. Affected Components • `src/gateway/session-utils.ts` (`resolveIdentityAvatarUrl`) Affected Packages / Versions • Package: `openclaw` (npm) • Introduced: `v2026.1.21` • Affected published versions: `<= 2026.2.21-2` • Planned patched version: `2026.2.22` Remediation • Resolve workspace and avatar paths with `realpath` and enforce realpath containment. • Open files with `O_NOFOLLOW` when available. • Compare pre-open and opened file identity (`dev`/`ino`) to block swap races. • Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance. Fix Commit(s) • `3d0337504349954237d09e4d957df5cb844d5e77` OpenClaw thanks @aether-ai-agent for reporting.