GHSA-9f72-qcpw-2hxc

OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

High npm

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 Improper Access Control
Fix: 2026.2.24; Upgrade openclaw to this version or later

Description

Summary

In sandboxed runs, native prompt image auto-load did not honor tools.fs.workspaceOnly=true.

This optional hardening setting is not enabled by default. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example /agent/secret.png) and load those image bytes for vision-capable model input.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version at triage time: 2026.2.23
Vulnerable version range: <= 2026.2.23
Patched version (planned next release): 2026.2.24

Conditions Required

This issue required all of the following:

sandbox mode enabled,
tools.fs.workspaceOnly=true configured,
an out-of-workspace mount path reachable from the sandbox (for example /agent),
vision-capable model path active for native prompt image loading.

Technical Details

Native prompt image ingestion (detectAndLoadPromptImages / loadImageFromRef) resolved and read sandbox paths but did not apply the same workspace-root assertion used by file tools when tools.fs.workspaceOnly was set.

Fix Commit(s)

370d115549c0dadace0902775eea0d5094aedfdc

Verification

pnpm check
pnpm exec vitest run --config vitest.gateway.config.ts
pnpm test:fast

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.24) so once npm release is available, this advisory only needs publish action.

OpenClaw thanks @tdjackey for reporting.

Publication Update (2026-02-25)

openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

Affected versions

npm

Package	Vulnerable	Fixed in
openclaw	`< 2026.2.24`	`2026.2.24`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openclaw npm → `2026.2.24`

npm

npm install openclaw@2026.2.24

yarn

yarn add openclaw@2026.2.24

pnpm

pnpm add openclaw@2026.2.24

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): High
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.