GHSA-cfp9-w5v9-3q4h

Suggest an improvement
Source
https://github.com/advisories/GHSA-cfp9-w5v9-3q4h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cfp9-w5v9-3q4h/GHSA-cfp9-w5v9-3q4h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cfp9-w5v9-3q4h
Aliases
  • CVE-2026-35658
Downstream
Published
2026-03-26T21:48:06Z
Modified
2026-04-10T20:03:56.902453Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts
Details

Summary

The image tool did not fully honor the tools.fs.workspaceOnly filesystem boundary. In affected releases, image-path resolution could still traverse sandbox bridge mounts outside the workspace and read files from mounted directories that the other file tools would reject.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.2
  • Fixed: >= 2026.3.2
  • Latest released tags checked: v2026.3.23 (ccfeecb6887cd97937e33a71877ad512741e82b2) and v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

  • dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53
  • 14baadda2c456f3cf749f1f97e8678746a34a7f4

Release Status

The complete fix shipped in v2026.3.2 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

  • src/agents/openclaw-tools.ts now passes fsPolicy into createImageTool, so the image tool receives the same workspace-only policy input as the other filesystem tools.
  • src/agents/tools/image-tool.ts, src/agents/tools/media-tool-shared.ts, and src/agents/sandbox-media-paths.ts now restrict local roots and sandbox-bridge resolution to the workspace when tools.fs.workspaceOnly is enabled.

OpenClaw thanks @YLChen-007 for reporting.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T21:48:06Z",
    "cwe_ids": [
        "CWE-668",
        "CWE-863"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2026-04-10T17:17:07Z"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cfp9-w5v9-3q4h/GHSA-cfp9-w5v9-3q4h.json"