https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:06:32 +0000 https://vulnerability.circl.lu/vuln/ghsa-9mph-4f7v-fmvh <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 `data:` URL in gateway responses.</p> <p>## Impact - Confidentiality impact: local file read in the gateway process context. - Exfiltration path: `agents.list` can return the resulting `avatarUrl` payload.</p> <p>## Affected Components - `src/gateway/session-utils.ts` (`resolveIdentityAvatarUrl`)</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Introduced: `v2026.1.21` - Affected published versions: `&lt;= 2026.2.21-2` - Planned patched version: `2026.2.22`</p> <p>## Remediation - Resolve workspace and avatar paths with `realpath` and enforce realpath containment. - Open files with `O_NOFOLLOW` when available. - Compare pre-open and opened file identity (`dev`/`ino`) to block swap races. - Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance.</p> <p>## Fix Commit(s) - `3d0337504349954237d09e4d957df5cb844d5e77`</p> <p>OpenClaw thanks @aether-ai-agent for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 `data:` URL in gateway responses.</p> <p>## Impact - Confidentiality impact: local file read in the gateway process context. - Exfiltration path: `agents.list` can return the resulting `avatarUrl` payload.</p> <p>## Affected Components - `src/gateway/session-utils.ts` (`resolveIdentityAvatarUrl`)</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Introduced: `v2026.1.21` - Affected published versions: `&lt;= 2026.2.21-2` - Planned patched version: `2026.2.22`</p> <p>## Remediation - Resolve workspace and avatar paths with `realpath` and enforce realpath containment. - Open files with `O_NOFOLLOW` when available. - Compare pre-open and opened file identity (`dev`/`ino`) to block swap races. - Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance.</p> <p>## Fix Commit(s) - `3d0337504349954237d09e4d957df5cb844d5e77`</p> <p>OpenClaw thanks @aether-ai-agent for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-9mph-4f7v-fmvh