GHSA-66r7-m7xm-v49h: OpenClaw: QQBot media tags could read arbitrary local files through reply text

Summary

The openclaw npm package, versions below 2026.4.10, let QQBot outbound media tags in AI reply text reference host-local paths outside the intended media storage boundary. This allowed local file disclosure through outbound media handling, and the fix enforces the boundary for all outbound QQBot local file paths.

Mitigation

Fixed in v2026.4.10 (PR #63271, commit 604777e4414cc3b2ff8861f18f4fb04374c702c6). Users should upgrade to openclaw 2026.4.10 or newer; the latest npm release, 2026.4.14, already includes the fix.

Related items

• InfoResearchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six DaysSimilar attack · The Hacker News
• MediumAn AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.Similar attack · The Hacker News
• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer