GHSA-wfp2-v9c7-fh79 OpenClaw affected by SSRF via attachment/media URL hydration

• npm openclaw: < 2026.2.2 → fixed in 2026.2.2

Summary Versions of the `openclaw` npm package prior to `2026.2.2` could be coerced into fetching arbitrary `http(s)` URLs during attachment/media hydration. An attacker who can influence the media URL (for example via model-controlled `sendAttachment` or auto-reply media URLs) could trigger SSRF to internal resources and exfiltrate the fetched bytes as an outbound attachment. Plain-English Explanation OpenClaw can send files by downloading them first. On vulnerable versions (`= 2026.2.2` Release timeline (npm): • `2026.2.1` published `2026-02-02T11:45:27Z` • `2026.2.2` published `2026-02-04T00:56:41Z` • This advisory was created `2026-02-05T10:42:26Z` Details In affected versions, remote media fetching performed a raw `fetch(url)` without SSRF protections. Starting in `2026.2.2`, remote media fetching is guarded by SSRF checks (private/loopback/link-local blocking, DNS pinning, and redirect handling), so attempts to fetch `127.0.0.1`, private RFC1918 space, or cloud metadata hostnames are rejected. Proof of Concept From any context where an attacker can influence an attachment/media URL, provide a media URL targeting an internal endpoint (example: `http://127.0.0.1:9999/secret.txt`). On vulnerable versions (`= 2026.2.2`. Thanks @simecek for reporting.