GHSA-jq4x-98m3-ggq6: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability

Summary

The OpenClaw gateway's canvas tool accepts an a2ui_push action with a jsonlPath parameter and reads that file with fs.readFile() in src/agents/tools/canvas-tool.ts, with no path validation, canonicalization, or directory restriction. An authenticated attacker, including a prompt-injected AI agent holding the gateway token, can read arbitrary files such as /etc/passwd, and the contents are forwarded to a connected node via canvas.a2ui.pushJSONL. Tested on openclaw 2026.2.17 and macOS 26.3.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)