N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9f72-qcpw-2hxc

GHSA-9f72-qcpw-2hxc: OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

Summary

In sandboxed runs, native prompt image auto-load did not honor tools.fs.workspaceOnly=true.

This optional hardening setting is not enabled by default. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example /agent/secret.png) and load those image bytes for vision-capable model input.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version at triage time: 2026.2.23
Vulnerable version range: <= 2026.2.23
Patched version (planned next release): 2026.2.24

Conditions Required

This issue required all of the following:

sandbox mode enabled,
tools.fs.workspaceOnly=true configured,
an out-of-workspace mount path reachable from the sandbox (for example /agent),
vision-capable model path active for native prompt image loading.

Technical Details

Native prompt image ingestion (detectAndLoadPromptImages / loadImageFromRef) resolved and read sandbox paths but did not apply the same workspace-root assertion used by file tools when tools.fs.workspaceOnly was set.

Fix Commit(s)

370d115549c0dadace0902775eea0d5094aedfdc

Verification

pnpm check
pnpm exec vitest run --config vitest.gateway.config.ts
pnpm test:fast

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.24) so once npm release is available, this advisory only needs publish action.

OpenClaw thanks @tdjackey for reporting.

Publication Update (2026-02-25)

openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9f72-qcpw-2hxc

GHSA-9f72-qcpw-2hxc:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.23	2026.2.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed native prompt image auto-loading to bypass the tools.fs.workspaceOnly=true security setting in sandboxed environments, enabling access to files outside the intended workspace. The root cause was the failure to check this security flag during file path resolution for images.

The analysis of the patch commit 370d115549c0dadace0902775eea0d5094aedfdc reveals the exact functions involved. The core of the vulnerability lies in loadImageFromRef in src/agents/pi-embedded-runner/run/images.ts, which, prior to the patch, would load any file path it was given without validating it against the workspace root. The fix was to add a call to assertSandboxPath within this function, conditioned on a new workspaceOnly parameter.

This workspaceOnly parameter is passed down from the detectAndLoadPromptImages function in the same file, which in turn receives it from runEmbeddedAttempt in src/agents/pi-embedded-runner/run/attempt.ts. These two functions were part of the vulnerability by failing to propagate the security setting. Therefore, during exploitation, runEmbeddedAttempt, detectAndLoadPromptImages, and loadImageFromRef would all appear in the runtime profile as they form the direct call chain that leads to the unauthorized file access.

Vulnerable functions

loadImageFromRef

src/agents/pi-embedded-runner/run/images.ts

This function is responsible for loading an image from a given path. Before the patch, it resolved the file path but did not perform any validation to ensure the path was within the designated workspace, even when the `tools.fs.workspaceOnly` setting was enabled. This allowed it to load image files from arbitrary locations accessible within the sandbox, bypassing the intended security boundary.

detectAndLoadPromptImages

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-9f72-qcpw-2hxc: OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

Summary

Affected Packages / Versions

Conditions Required

Technical Details

Fix Commit(s)

Verification

Release Process Note

Publication Update (2026-02-25)

GHSA-9f72-qcpw-2hxc:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-9f72-qcpw-2hxc: OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

Summary

Affected Packages / Versions

Conditions Required

Technical Details

Fix Commit(s)

Verification

Release Process Note

Publication Update (2026-02-25)

Technical Details

N/A

N/A

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI