BREW-OPENCLAW-CLI-CVE-20… (GHSA-R8G4-86FX-92MQ)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:21 – Updated: 2026-09-25 08:57 – Source website
VLAI
Summary
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
Details

Summary

The isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel.

Details

Location: src/media/parse.ts:17-27

The path validation accepts dangerous patterns:

function isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) {
  if (candidate.startsWith("/")) return true;      // ALLOWS /etc/passwd
  if (candidate.startsWith("./")) return true;
  if (candidate.startsWith("../")) return true;    // ALLOWS ../../etc/passwd
  if (candidate.startsWith("~")) return true;      // ALLOWS ~/secrets
  return false;
}

No validation ensures the path is within a safe directory or is actually a media file.

PoC

Agent outputs any of:

MEDIA:/etc/passwd
MEDIA:~/.ssh/id_rsa
MEDIA:~/.aws/credentials
MEDIA:../../../etc/passwd

The file contents are rendered/sent to the requesting user or channel.

Impact

  • Read ANY file accessible to the agent user
  • Exfiltrate SSH keys (~/.ssh/id_rsa)
  • Steal cloud credentials (~/.aws/credentials)
  • Access API keys (.env, config.json)
  • Read system files (/etc/passwd, /etc/shadow)

Note: PR #4930 contains a fix but is NOT MERGED - production is vulnerable.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "2026.1.30"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "openclaw-cli",
        "purl": "pkg:brew/openclaw-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.1.29"
            },
            {
              "fixed": "2026.1.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/openclaw@2026.9.6",
        "name": "openclaw",
        "strategy": "registry",
        "subject_version": "2026.9.6"
      }
    ]
  },
  "details": "### Summary\nThe `isValidMedia()` function in `src/media/parse.ts` allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting `MEDIA:/path/to/file`, exfiltrating sensitive data to the user/channel.\n\n### Details\n**Location:** `src/media/parse.ts:17-27`\n\nThe path validation accepts dangerous patterns:\n\n```typescript\nfunction isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) {\n  if (candidate.startsWith(\"/\")) return true;      // ALLOWS /etc/passwd\n  if (candidate.startsWith(\"./\")) return true;\n  if (candidate.startsWith(\"../\")) return true;    // ALLOWS ../../etc/passwd\n  if (candidate.startsWith(\"~\")) return true;      // ALLOWS ~/secrets\n  return false;\n}\n```\n\nNo validation ensures the path is within a safe directory or is actually a media file.\n\n### PoC\n\nAgent outputs any of:\n```\nMEDIA:/etc/passwd\nMEDIA:~/.ssh/id_rsa\nMEDIA:~/.aws/credentials\nMEDIA:../../../etc/passwd\n```\n\nThe file contents are rendered/sent to the requesting user or channel.\n\n### Impact\n- Read ANY file accessible to the agent user\n- Exfiltrate SSH keys (`~/.ssh/id_rsa`)\n- Steal cloud credentials (`~/.aws/credentials`)\n- Access API keys (`.env`, `config.json`)\n- Read system files (`/etc/passwd`, `/etc/shadow`)\n\n**Note:** PR #4930 contains a fix but is NOT MERGED - production is vulnerable.",
  "id": "BREW-openclaw-cli-CVE-2026-25475",
  "modified": "2026-09-25T08:57:17Z",
  "published": "2026-08-13T17:21:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25475"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction",
  "upstream": [
    "GHSA-r8g4-86fx-92mq",
    "CVE-2026-25475"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.