https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:56:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-25475 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.</p> https://vulnerability.circl.lu/vuln/cve-2026-25475 https://vulnerability.circl.lu/vuln/ghsa-r8g4-86fx-92mq <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary The `isValidMedia()` function in `src/media/parse.ts` allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting `MEDIA:/path/to/file`, exfiltrating sensitive data to the user/channel.</p> <p>### Details **Location:** `src/media/parse.ts:17-27`</p> <p>The path validation accepts dangerous patterns:</p> <p>```typescript function isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) { if (candidate.startsWith(&#34;/&#34;)) return true; // ALLOWS /etc/passwd if (candidate.startsWith(&#34;./&#34;)) return true; if (candidate.startsWith(&#34;../&#34;)) return true; // ALLOWS ../../etc/passwd if (candidate.startsWith(&#34;~&#34;)) return true; // ALLOWS ~/secrets return false; } ```</p> <p>No validation ensures the path is within a safe directory or is actually a media file.</p> <p>### PoC</p> <p>Agent outputs any of: ``` MEDIA:/etc/passwd MEDIA:~/.ssh/id_rsa MEDIA:~/.aws/credentials MEDIA:../../../etc/passwd ```</p> <p>The file contents are rendered/sent to the requesting user or channel.</p> <p>### Impact - Read ANY file accessible to the agent user - Exfiltrate SSH keys (`~/.ssh/id_rsa`) - Steal cloud credentials (`~/.aws/credentials`) - Access API keys (`.env`, `config.json`) - Read system files (`/etc/passwd`, `/etc/shadow`)</p> <p>**Note:** PR #4930 contains a fix but is NOT MERGED - production is vulnerable.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary The `isValidMedia()` function in `src/media/parse.ts` allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting `MEDIA:/path/to/file`, exfiltrating sensitive data to the user/channel.</p> <p>### Details **Location:** `src/media/parse.ts:17-27`</p> <p>The path validation accepts dangerous patterns:</p> <p>```typescript function isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) { if (candidate.startsWith(&#34;/&#34;)) return true; // ALLOWS /etc/passwd if (candidate.startsWith(&#34;./&#34;)) return true; if (candidate.startsWith(&#34;../&#34;)) return true; // ALLOWS ../../etc/passwd if (candidate.startsWith(&#34;~&#34;)) return true; // ALLOWS ~/secrets return false; } ```</p> <p>No validation ensures the path is within a safe directory or is actually a media file.</p> <p>### PoC</p> <p>Agent outputs any of: ``` MEDIA:/etc/passwd MEDIA:~/.ssh/id_rsa MEDIA:~/.aws/credentials MEDIA:../../../etc/passwd ```</p> <p>The file contents are rendered/sent to the requesting user or channel.</p> <p>### Impact - Read ANY file accessible to the agent user - Exfiltrate SSH keys (`~/.ssh/id_rsa`) - Steal cloud credentials (`~/.aws/credentials`) - Access API keys (`.env`, `config.json`) - Read system files (`/etc/passwd`, `/etc/shadow`)</p> <p>**Note:** PR #4930 contains a fix but is NOT MERGED - production is vulnerable.</p> https://vulnerability.circl.lu/vuln/ghsa-r8g4-86fx-92mq