A vulnerability in the openclaw npm package versions 2026.4.7 through 2026.4.9 allowed Discord event cover images to bypass sandbox media normalization. This flaw permitted host-local media references to reach channel action paths expecting normalized media, potentially exposing sensitive local media. The issue was fixed in version 2026.4.10.