Openclaw cli: OpenClaw: Discord event cover images bypassed sandbox media normalization (CVE-2026-43532)
Description
A vulnerability in openclaw-cli versions 2026.4.7 through 2026.4.9 allows Discord event cover images to bypass sandbox media normalization. This flaw permits host-local media references to reach a channel action path that expects normalized media, potentially exposing sensitive local media. The issue is fixed in version 2026.4.10 and later.
CVSS v3.1
Score 7.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openclaw-cli package for npm versions >=2026.4.7 and <2026.4.10 contains a vulnerability where Discord event cover image parameters bypass the sandbox media normalization process. This bypass allows host-local media references to be used in a channel action path that requires media to be normalized, potentially leading to unintended media exposure. The vulnerability was addressed by including Discord eventCreate.image in the sandbox media normalization process and covering the event-create media path. The fix was implemented in commit 979c6f09d6fad96596feb91c905934be7e0b4f15 and released in version 2026.4.10 and later.
Potential Impact
The vulnerability allows host-local media references to bypass sandbox media normalization, which could lead to exposure of local media in contexts expecting normalized media. The CVSS score of 7.7 (high severity) reflects the potential for confidentiality impact without affecting integrity or availability.
Mitigation Recommendations
Users should upgrade openclaw-cli to version 2026.4.10 or later. The issue is fixed in these versions, and no additional mitigation steps are required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-43532
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2459512601ec6a3165cab
Added to database: 10/04/2026, 12:24:53 UTC
Last enriched: 10/04/2026, 12:42:27 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.