N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g2f6-pwvx-r275

GHSA-g2f6-pwvx-r275: OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection

Summary

openclaw versions <= 2026.3.12 accepted unsanitized iMessage remote attachment paths when staging files over SCP, allowing shell metacharacters in the remote path operand.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.12
Fixed version: 2026.3.13

Details

The vulnerable path was the remote attachment staging flow in src/auto-reply/reply/stage-sandbox-media.ts. When ctx.MediaRemoteHost was set, OpenClaw staged the attachment by spawning /usr/bin/scp against <remoteHost>:<remotePath>. In affected releases, the remote host was normalized but the remote attachment path was not validated for shell metacharacters before being passed to the SCP remote operand. A sender-controlled iMessage attachment filename containing shell metacharacters could therefore trigger command execution on the configured remote host when remote attachment staging was enabled.

This issue is in scope under OpenClaw's trust model because it crosses an inbound content boundary into host command execution on a configured remote attachment host.

Fix

openclaw@2026.3.13 validates the SCP remote path before spawning scp. Current code calls normalizeScpRemotePath(...) and rejects paths containing shell metacharacters instead of passing them through to the remote shell.

Regression coverage exists in src/auto-reply/reply.stage-sandbox-media.scp-remote-path.test.ts (rejects remote attachment filenames with shell metacharacters before spawning scp).

Fix Commit(s)

a54bf71b4c0cbe554a84340b773df37ee8e959de

Thanks @lintsinghua for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-g2f6-pwvx-r275

GHSA-g2f6-pwvx-r275:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.12	2026.3.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the openclaw package's iMessage attachment handling. Specifically, when staging attachments to a remote host via SCP, the filename of the attachment was used to construct the remote path without proper sanitization. This allowed an attacker to include shell metacharacters in the filename of an iMessage attachment, which would then be executed on the remote SCP host.

The analysis of the patch a54bf71b4c0cbe554a84340b773df37ee8e959de reveals the exact location of the vulnerability. The function stageSandboxMedia in src/auto-reply/reply/stage-sandbox-media.ts is the high-level function that orchestrates the file staging. It calls the internal function scpFile with the unsanitized path. The scpFile function is where the scp command is constructed and executed using spawn. The patch introduces a new function, normalizeScpRemotePath, in src/infra/scp-host.ts, which is then used within scpFile to sanitize the remote path before it is passed to the scp command, thus mitigating the command injection vulnerability.

Vulnerable functions

scpFile

src/auto-reply/reply/stage-sandbox-media.ts

The `scpFile` function is responsible for spawning the `/usr/bin/scp` process. Before the fix, it directly used the `remotePath` variable in the command arguments. This `remotePath` could contain malicious shell metacharacters from an iMessage attachment filename, leading to remote command execution on the configured SCP host.

stageSandboxMedia

src/auto-reply/reply/stage-sandbox-media.ts

This function serves as the entry point for the vulnerable remote attachment staging flow. It takes the `ctx.MediaPath`, which is derived from a potentially malicious iMessage attachment filename, and passes it down to the `scpFile` function for processing, initiating the sequence that leads to command injection.

normalizeScpRemotePath

src/infra/scp-host.ts

This function was added as part of the fix to sanitize the remote path used in the `scp` command. It checks for and rejects paths containing unsafe shell metacharacters. Its introduction indicates that the lack of such validation was the root cause of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.