{"data":{"id":"6011a294-0e48-4c49-a21a-ddf730f40fb8","title":"GHSA-8jpq-5h99-ff5r: OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension","summary":"The Feishu extension in OpenClaw versions before 2026.2.14 let `sendMediaFeishu` treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. An attacker who can influence tool calls, directly or through prompt injection, could exfiltrate local files such as `/etc/passwd`.","solution":"Upgrade to OpenClaw `2026.2.14` or newer. The fix, commit 5b4121d60, removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-8jpq-5h99-ff5r","publishedAt":"2026-02-17T21:41:52.000Z","cveId":"CVE-2026-26321","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.14 (fixed: 2026.2.14)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw","Feishu"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00532,"epssCheckedAt":"2026-11-04T06:10:15.237Z","kevDateAdded":null,"advisoryAliases":["GHSA-8jpq-5h99-ff5r"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:40:59.114Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.14","matchedVersion":"2026.2.14","fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-2,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:58.968Z"}]}}