AI agent vulnerability · OpenClaw

CVE-2026-33581: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

highCVSS 4.0 7.1 · 3.1 6.2GHSA-v8wv-jg3q-qwpq

Summary The message tool accepted mediaUrl and fileUrl aliases without applying the same sandbox localRoots validation as the canonical media path handling. Impact A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters.

Published Mar 31, 2026 · Updated Apr 6, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.3.24
Fixed in: 2026.3.24
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

The message tool accepted mediaUrl and fileUrl aliases without applying the same sandbox localRoots validation as the canonical media path handling.

Impact

A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters.

Affected Component

src/infra/outbound/message-action-params.ts, src/infra/outbound/message-action-runner.ts

Fixed Versions

Affected: < 2026.3.24
Patched: >= 2026.3.24
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 1d7cb6fc03 (fix: close sandbox media root bypass for mediaUrl/fileUrl aliases).

OpenClaw thanks @AntAISecurityLab for reporting.

Credited to AntAISecurityLab.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries