Openclaw cli: OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

The openclaw-cli package (npm) had a vulnerability where native prompt image ingestion functions did not enforce the tools.fs.workspaceOnly=true restriction during sandboxed runs. This allowed image references in prompts to load files from out-of-workspace mounted paths, bypassing the intended filesystem access restrictions. The issue required sandbox mode enabled, the workspaceOnly setting configured, an accessible out-of-workspace mount path, and vision-capable model input active. The vulnerability affects versions >=2026.1.29 and <2026.2.24. A fix was introduced in commit 370d115549c0dadace0902775eea0d5094aedfdc and released in [email protected].

When the optional hardening setting tools.fs.workspaceOnly=true is enabled in sandbox mode, this vulnerability allows prompt text to load image files from paths outside the designated workspace. This could lead to unintended exposure of sensitive image data mounted outside the workspace to vision-capable model inputs. The impact is limited to environments where sandbox mode and the workspaceOnly setting are both enabled and an out-of-workspace mount path is accessible.

A patch is available in openclaw version 2026.2.24 which enforces the workspaceOnly restriction for native prompt image loading in sandboxed runs. Operators should upgrade to version 2026.2.24 or later to remediate this issue. Until patched, operators should consider disabling sandbox mode or the tools.fs.workspaceOnly setting if feasible, or ensure no sensitive out-of-workspace mounts are accessible.