Threats tagged 'ghsa-hfjp-hq7w-7gcf'

CVE-2026-100526 is a medium severity vulnerability in the OpenClaw Discord integration npm package (@openclaw/discord) before version 2026.9.3. It allows a sender with permission to invoke emoji and sticker upload actions to bypass sender-scoped media policy restrictions and cause OpenClaw to read local files outside the allowed media roots. This can lead to out-of-policy local file bytes being included in outbound emoji or sticker uploads. Exploitation requires both access to the guild asset action and knowledge or derivation of a useful local file path. The vulnerability does not allow unrestricted filesystem browsing or code execution. The issue is fixed in version 2026.9.3.