https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 15:18:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32002 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictions on mounted sandbox paths, allowing attackers to read out-of-workspace files. Attackers can load restricted mounted images and exfiltrate them through vision model provider requests to bypass sandbox confidentiality controls.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictions on mounted sandbox paths, allowing attackers to read out-of-workspace files. Attackers can load restricted mounted images and exfiltrate them through vision model provider requests to bypass sandbox confidentiality controls.</p> https://vulnerability.circl.lu/vuln/cve-2026-32002 https://vulnerability.circl.lu/vuln/ghsa-q6qf-4p5j-r25g <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In OpenClaw, the sandboxed `image` tool did not honor `tools.fs.workspaceOnly=true` for mounted paths resolved by the sandbox FS bridge. This allowed reading out-of-workspace mounted images (for example `/agent/*`) and forwarding those bytes to vision model providers.</p> <p>### Impact Sandbox boundary bypass with confidentiality impact. In affected versions, `read`/`write`/`edit` respected workspace-only guardrails, but `image` could still load mounted out-of-workspace files and exfiltrate them via model requests.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.22-2` - Patched versions: `&gt;= 2026.2.23` (released) - Latest published npm at triage time: `2026.2.22-2`</p> <p>### Technical Details `workspaceOnly` was enforced in sandbox file tools and `apply_patch`, but not propagated/enforced for `image` sandbox path resolution. The fix threads `workspaceOnly` into image-tool construction and asserts sandbox-root containment before loading media bytes.</p> <p>### Fix Commit(s) - `dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53`</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In OpenClaw, the sandboxed `image` tool did not honor `tools.fs.workspaceOnly=true` for mounted paths resolved by the sandbox FS bridge. This allowed reading out-of-workspace mounted images (for example `/agent/*`) and forwarding those bytes to vision model providers.</p> <p>### Impact Sandbox boundary bypass with confidentiality impact. In affected versions, `read`/`write`/`edit` respected workspace-only guardrails, but `image` could still load mounted out-of-workspace files and exfiltrate them via model requests.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.22-2` - Patched versions: `&gt;= 2026.2.23` (released) - Latest published npm at triage time: `2026.2.22-2`</p> <p>### Technical Details `workspaceOnly` was enforced in sandbox file tools and `apply_patch`, but not propagated/enforced for `image` sandbox path resolution. The fix threads `workspaceOnly` into image-tool construction and asserts sandbox-root containment before loading media bytes.</p> <p>### Fix Commit(s) - `dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53`</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-q6qf-4p5j-r25g