Threats tagged 'ghsa-mr34-9552-qr95'

OpenClaw versions from 2026.4.7 up to but not including 2026.4.15 contain a vulnerability in the webchat media embedding feature. This flaw allows crafted tool-result media references to bypass local-root containment policies, potentially causing the host to read local files or access Windows UNC/network paths. This could lead to disclosure of host files or exposure of network credentials on Windows systems. The issue is fixed in version 2026.4.15, which enforces strict local-root containment and rejects remote-host file URLs and Windows network paths before any filesystem access.