GHSA-45CG-2683-GFMQ

Vulnerability from github – Published: 2026-03-03 21:37 – Updated: 2026-03-19 22:19
VLAI
Summary
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Details

Impact

assertBrowserNavigationAllowed() validated only http:/https: network targets but implicitly allowed other schemes. An authenticated gateway user could navigate browser sessions to file:// URLs and read local files via browser snapshot/extraction flows.

Affected Component

  • src/browser/navigation-guard.ts

Technical Reproduction

  1. Authenticate to a gateway that has browser tooling enabled.
  2. Invoke browser navigation with a file:// URL (for example file:///etc/passwd).
  3. Read page content through browser snapshot/extract actions.

Demonstrated Impact

An attacker with valid gateway credentials and browser-tool access can exfiltrate local files readable by the OpenClaw process user (for example config/secrets in that user context).

Environment

  • OpenClaw browser tool enabled
  • Attacker has authenticated access capable of invoking browser actions

Remediation Advice

Reject unsupported navigation schemes and allow only explicitly safe non-network URLs. OpenClaw now blocks non-network schemes (such as file:, data:, and javascript:) while preserving about:blank.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.19-2
  • Patched in planned next release: 2026.2.21

Fix Commit(s)

  • 220bd95eff6838234e8b4b711f86d4565e16e401

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21) so once npm 2026.2.21 is published, the advisory can be published directly.

OpenClaw thanks @q1uf3ng for reporting.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:37:59Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Impact\n\n`assertBrowserNavigationAllowed()` validated only `http:`/`https:` network targets but implicitly allowed other schemes. An authenticated gateway user could navigate browser sessions to `file://` URLs and read local files via browser snapshot/extraction flows.\n\n## Affected Component\n\n- `src/browser/navigation-guard.ts`\n\n## Technical Reproduction\n\n1. Authenticate to a gateway that has browser tooling enabled.\n2. Invoke browser navigation with a `file://` URL (for example `file:///etc/passwd`).\n3. Read page content through browser snapshot/extract actions.\n\n## Demonstrated Impact\n\nAn attacker with valid gateway credentials and browser-tool access can exfiltrate local files readable by the OpenClaw process user (for example config/secrets in that user context).\n\n## Environment\n\n- OpenClaw browser tool enabled\n- Attacker has authenticated access capable of invoking browser actions\n\n## Remediation Advice\n\nReject unsupported navigation schemes and allow only explicitly safe non-network URLs. OpenClaw now blocks non-network schemes (such as `file:`, `data:`, and `javascript:`) while preserving `about:blank`.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.19-2`\n- Patched in planned next release: `2026.2.21`\n\n## Fix Commit(s)\n\n- `220bd95eff6838234e8b4b711f86d4565e16e401`\n\n## Release Process Note\n\n`patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm `2026.2.21` is published, the advisory can be published directly.\n\nOpenClaw thanks @q1uf3ng for reporting.",
  "id": "GHSA-45cg-2683-gfmq",
  "modified": "2026-03-19T22:19:19Z",
  "published": "2026-03-03T21:37:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-45cg-2683-gfmq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/220bd95eff6838234e8b4b711f86d4565e16e401"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.