MediumVulnerabilityLLM-specific
GHSA-gfg9-5357-hv4c: OpenClaw: Webchat audio embedding could read local files without local-root containment
- Identifier
- GHSA-gfg9-5357-hv4c
- Published
- Record updated
- Affected
- openclaw <= 2026.4.14
- Fixed in
- 2026.4.15
- released April 16, 2026, 13 days before disclosure
Summary
OpenClaw deployments before 2026.4.15 could embed host-local audio files into webchat responses without the local media root containment check used by other media-serving paths. If an attacker could influence a tool-produced ReplyPayload.mediaUrl, the webchat audio embedding helper could read an audio-like file under the size cap and return it base64-encoded, crossing from model or tool output into a host file read.
Mitigation
Upgrade to openclaw@2026.4.15 or later; the latest public release, 2026.4.21, is fixed. Before upgrading, avoid exposing webchat sessions to untrusted prompt or tool content that can influence reply media URLs.
Related items
- LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
- MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
- LowCVE-2026-123498: Vikunja veans prompt injection through project titles and task contentSimilar attack · NVD/CVE Database
- MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
- MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database