GitHub Advisoryadvisory · npm

GHSA-v8wv-jg3q-qwpq OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

HIGH Published 2026-03-31 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-33581
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-03-31

Affected packages

• npm openclaw: < 2026.3.24 → fixed in 2026.3.24

Description

Summary The message tool accepted `mediaUrl` and `fileUrl` aliases without applying the same sandbox localRoots validation as the canonical media path handling. Impact A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters. Affected Component `src/infra/outbound/message-action-params.ts, src/infra/outbound/message-action-runner.ts` Fixed Versions • Affected: `= 2026.3.24` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `1d7cb6fc03` (`fix: close sandbox media root bypass for mediaUrl/fileUrl aliases`). OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-33581 OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References