AI agent vulnerability · OpenClaw

GHSA-9mph-4f7v-fmvh: OpenClaw has agent avatar symlink traversal in gateway session metadata

mediumCVSS 4.0 6.9

Summary A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL in gateway responses. Impact - Confidentiality impact: local file read in the gateway process context. - Exfiltration path: agents.list can return the resulting avatarUrl payload.

Published Mar 4, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.22
Fixed in: 2026.2.22
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL in gateway responses.

Impact

Confidentiality impact: local file read in the gateway process context.
Exfiltration path: agents.list can return the resulting avatarUrl payload.

Affected Components

src/gateway/session-utils.ts (resolveIdentityAvatarUrl)

Affected Packages / Versions

Package: openclaw (npm)
Introduced: v2026.1.21
Affected published versions: <= 2026.2.21-2
Planned patched version: 2026.2.22

Remediation

Resolve workspace and avatar paths with realpath and enforce realpath containment.
Open files with O_NOFOLLOW when available.
Compare pre-open and opened file identity (dev/ino) to block swap races.
Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance.

Fix Commit(s)

3d0337504349954237d09e4d957df5cb844d5e77

OpenClaw thanks @aether-ai-agent for reporting.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries