GHSA-qxgf-hmcj-3xw3

Suggest an improvement
Source
https://github.com/advisories/GHSA-qxgf-hmcj-3xw3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qxgf-hmcj-3xw3/GHSA-qxgf-hmcj-3xw3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qxgf-hmcj-3xw3
Aliases
  • CVE-2026-34504
Downstream
Published
2026-04-01T00:01:51Z
Modified
2026-04-06T23:06:02.131039Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L CVSS Calculator
Summary
OpenClaw affected by SSRF via unguarded image download in fal provider
Details

Summary

The fal provider used raw fetches for both provider API traffic and returned image download URLs instead of the existing SSRF-guarded fetch path.

Impact

A malicious or compromised fal relay could make the gateway fetch internal URLs and expose metadata or internal service responses through the image pipeline.

Affected Component

extensions/fal/image-generation-provider.ts

Fixed Versions

  • Affected: <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 80d1e8a11a (fal: guard image fetches).

OpenClaw thanks @AntAISecurityLab for reporting.

Database specific 
{
    "nvd_published_at": null,
    "severity": "LOW",
    "github_reviewed_at": "2026-04-01T00:01:51Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "github_reviewed": true
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.28

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qxgf-hmcj-3xw3/GHSA-qxgf-hmcj-3xw3.json"
last_known_affected_version_range 
"<= 2026.3.24"