https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 10:54:42 +0000 https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-44996 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Impact</p> <p>OpenClaw deployments before `2026.4.15` could embed host-local audio files into webchat responses without applying the local media root containment check used by other media-serving paths.</p> <p>If an attacker could influence an agent or tool-produced `ReplyPayload.mediaUrl`, the webchat audio embedding helper could resolve an absolute local path or `file:` URL, read an audio-like file under the size cap, and base64-encode it into the webchat media response. This crossed the model/tool-output boundary into a host file read. Prompt injection or malicious tool output is a delivery mechanism; the security boundary failure is the missing local-root containment check.</p> <p>The impact is narrow: the file had to be readable by the gateway process, have an audio-like extension, and fit within the webchat audio size cap. The issue exposed contents into the webchat assistant/media transcript path; it was not a general remote filesystem API.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` on npm - Affected versions: `&lt;= 2026.4.14` - Patched version: `2026.4.15`</p> <p>The latest public release, `2026.4.21`, also contains the fix.</p> <p>## Patches</p> <p>The public fix threads the applicable local media roots into the webchat audio embedding path and calls `assertLocalMediaAllowed` before local audio content is read. Current `main` also includes an additional `trustedLocalMedia` gate so untrusted model/tool payloads cannot opt into local audio embedding.</p> <p>Fix commit:</p> <p>- `6e58f1f9f54bca1fea1268…</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Impact</p> <p>OpenClaw deployments before `2026.4.15` could embed host-local audio files into webchat responses without applying the local media root containment check used by other media-serving paths.</p> <p>If an attacker could influence an agent or tool-produced `ReplyPayload.mediaUrl`, the webchat audio embedding helper could resolve an absolute local path or `file:` URL, read an audio-like file under the size cap, and base64-encode it into the webchat media response. This crossed the model/tool-output boundary into a host file read. Prompt injection or malicious tool output is a delivery mechanism; the security boundary failure is the missing local-root containment check.</p> <p>The impact is narrow: the file had to be readable by the gateway process, have an audio-like extension, and fit within the webchat audio size cap. The issue exposed contents into the webchat assistant/media transcript path; it was not a general remote filesystem API.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` on npm - Affected versions: `&lt;= 2026.4.14` - Patched version: `2026.4.15`</p> <p>The latest public release, `2026.4.21`, also contains the fix.</p> <p>## Patches</p> <p>The public fix threads the applicable local media roots into the webchat audio embedding path and calls `assertLocalMediaAllowed` before local audio content is read. Current `main` also includes an additional `trustedLocalMedia` gate so untrusted model/tool payloads cannot opt into local audio embedding.</p> <p>Fix commit:</p> <p>- `6e58f1f9f54bca1fea1268…</p> https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-44996