OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset
Impact
sendAttachment and setGroupIcon message actions could hydrate media from local absolute paths when sandboxRoot was unset, bypassing intended local media root checks. This could allow reads of arbitrary host files reachable by the runtime user when an authorized message-action path was triggered.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version at triage:
2026.2.23 - Vulnerable:
<= 2026.2.23 - Patched in code:
>= 2026.2.24(planned next release)
Remediation
Upgrade to openclaw 2026.2.24 or later once published.
Fix Commit(s)
- 270ab03e379f9653e15f7033c9830399b66b7e51
Release Process Note
patched_versions is pre-set to the planned next release (>= 2026.2.24). Once that npm release is published, this advisory can be published without further field edits.
OpenClaw thanks @GCXWLP for reporting.
Publication Update (2026-02-25)
openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.2.24 | 2026.2.24 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-fqcm-97m6-w7rm
- https://nvd.nist.gov/vuln/detail/CVE-2026-27522
- https://github.com/openclaw/openclaw/commit/270ab03e379f9653e15f7033c9830399b66b7e51
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-sendattachment-and-setgroupicon-message-actions
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-200, CWE-22- Platform
- npm
- Package
openclaw- Disclosed
- 02.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-fqcm-97m6-w7rm - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.