N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-57gh-m6rq-54cf

GHSA-57gh-m6rq-54cf: OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration

Summary

Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration

Current Maintainer Triage

Status: narrow
Normalized severity: medium
Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

1ca4261d7e055d0be141ed79ebb1365d0fbc7364 — 2026-03-30T17:15:03+01:00

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-57gh-m6rq-54cf

GHSA-57gh-m6rq-54cf:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'Self-Whitelisting in appendLocalMediaParentRoots', allowed for arbitrary file reading and credential exfiltration in the openclaw package. The root cause was the appendLocalMediaParentRoots function in src/media/local-roots.ts. This function would insecurely add the parent directory of any user-provided local media file path to a list of whitelisted, readable directories. An attacker could provide a path to a file within a sensitive directory (e.g., /etc/secrets/somefile), and the application would then grant itself read access to the entire /etc/secrets/ directory. The resolveLocalMediaPath function aided this by resolving various user-input path formats into local file paths. The patch addresses this by removing the vulnerable logic from appendLocalMediaParentRoots, deleting resolveLocalMediaPath entirely, and modifying the functions getAgentScopedMediaLocalRootsForSources and resolveMediaToolLocalRoots to no longer use mediaSources to expand the accessible file system roots. Therefore, any of these four functions could appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

appendLocalMediaParentRoots

src/media/local-roots.ts

This function was responsible for the 'self-whitelisting' behavior. It would take media source paths, resolve them to local paths, and then add their parent directories to the list of allowed file system roots. This allowed an attacker to specify a file in a sensitive directory, and the application would then grant itself access to that entire directory.

resolveLocalMediaPath

src/media/local-roots.ts

This function was responsible for parsing and resolving a user-provided string into a local file path. It handled various formats that an attacker could use to specify a path to a sensitive file on the local system. The path returned by this function was then used by `appendLocalMediaParentRoots` to insecurely widen the accessible file system roots.

getAgentScopedMediaLocalRootsForSources

src/media/local-roots.ts

This function acted as an entry point for the vulnerability. Under certain configurations, it would call the vulnerable `appendLocalMediaParentRoots` function with user-provided media sources, which would trigger the self-whitelisting and expose sensitive directories.

resolveMediaToolLocalRoots

src/agents/tools/media-tool-shared.ts

This function was another entry point for the vulnerability. It called the vulnerable `appendLocalMediaParentRoots` function, passing user-provided media sources to it. This would lead to the insecure widening of file system access permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.