Affected: npm: openclaw

## Summary A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 `data:` URL in gateway responses.

## Impact - Confidentiality impact: local file read in the gateway process context. - Exfiltration path: `agents.list` can return the resulting `avatarUrl` payload.

## Affected Components - `src/gateway/session-utils.ts` (`resolveIdentityAvatarUrl`)

## Affected Packages / Versions - Package: `openclaw` (npm) - Introduced: `v2026.1.21` - Affected published versions: `<= 2026.2.21-2` - Planned patched version: `2026.2.22`

## Remediation - Resolve workspace and avatar paths with `realpath` and enforce realpath containment. - Open files with `O_NOFOLLOW` when available. - Compare pre-open and opened file identity (`dev`/`ino`) to block swap races. - Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance.

## Fix Commit(s) - `3d0337504349954237d09e4d957df5cb844d5e77`

OpenClaw thanks @aether-ai-agent for reporting.