GHSA-cfp9-w5v9-3q4h OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts

• npm openclaw: < 2026.3.2 → fixed in 2026.3.2

Summary The `image` tool did not fully honor the `tools.fs.workspaceOnly` filesystem boundary. In affected releases, image-path resolution could still traverse sandbox bridge mounts outside the workspace and read files from mounted directories that the other file tools would reject. Affected Packages / Versions • Package: `openclaw` (npm) • Affected: `= 2026.3.2` • Latest released tags checked: `v2026.3.23` (`ccfeecb6887cd97937e33a71877ad512741e82b2`) and `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) • Latest published npm version checked: `2026.3.23-2` Fix Commit(s) • `dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53` • `14baadda2c456f3cf749f1f97e8678746a34a7f4` Release Status The complete fix shipped in `v2026.3.2` and remains present in `v2026.3.23` and `v2026.3.23-2`. Code-Level Confirmation • `src/agents/openclaw-tools.ts` now passes `fsPolicy` into `createImageTool`, so the image tool receives the same workspace-only policy input as the other filesystem tools. • `src/agents/tools/image-tool.ts`, `src/agents/tools/media-tool-shared.ts`, and `src/agents/sandbox-media-paths.ts` now restrict local roots and sandbox-bridge resolution to the workspace when `tools.fs.workspaceOnly` is enabled. OpenClaw thanks @YLChen-007 for reporting.