{"data":{"id":"84c94a8a-df64-442f-9cc5-131044a03025","title":"GHSA-9mph-4f7v-fmvh: OpenClaw has agent avatar symlink traversal in gateway session metadata","summary":"A crafted local avatar path in OpenClaw's gateway can follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL. The flaw sits in resolveIdentityAvatarUrl in src/gateway/session-utils.ts, affects the openclaw npm package from v2026.1.21 through 2026.2.21-2, and allows local file read in the gateway process, which agents.list can return as avatarUrl.","solution":"Resolve workspace and avatar paths with realpath and enforce realpath containment. Open files with O_NOFOLLOW when available. Compare pre-open and opened file identity (dev/ino) to block swap races. Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance. Planned patched version: 2026.2.22.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-9mph-4f7v-fmvh","publishedAt":"2026-03-04T19:02:59.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.22 (fixed: 2026.2.22)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-9mph-4f7v-fmvh"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-23T00:36:27.582Z","daysToFix":-9,"fixCheckedAt":"2026-10-29T21:40:15.883Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.22","matchedVersion":"2026.2.22","fixReleasedAt":"2026-02-23T00:36:27.582Z","daysToFix":-9,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:15.733Z"}]}}