Threats tagged 'ghsa-58pr-gw4m-rw8v'

OpenClaw versions before 2026.4.15 have an arbitrary file read vulnerability in the QMD backend memory_get function. This flaw allows attackers with access to the memory tool to read any Markdown files within the workspace root by bypassing path restrictions. The vulnerability enables reading files outside the intended canonical memory locations or indexed QMD result sets.