GHSA-fwjq-xwfj-gv75 OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Summary `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations Current Maintainer Triage • Status: narrow • Normalized severity: medium • Assessment: Real on shipped v2026.3.22: non-sandboxed session_status skipped the shared visibility guard, but this is a same-agent session-policy bypass with unreleased fix, not a broader host-boundary break. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `4d369a3400dc9b737fbe8daa63f09d909ce7beb8` — 2026-03-30T16:48:12+02:00 Release Process Note • The fix is already present in released version `2026.3.31`. • This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @tdjackey for reporting.