N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qqq7-4hxc-x63c

GHSA-qqq7-4hxc-x63c: OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

Impact

Shared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file exfiltration.

A crafted shared reply MEDIA reference could cause another channel to read a local file path as trusted generated media.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <=2026.4.4
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @threalwinky for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qqq7-4hxc-x63c

GHSA-qqq7-4hxc-x63c:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.8	2026.4.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 reveals the vulnerability is located in the fetchWithSsrFGuard function within the src/infra/net/fetch-guard.ts file. The vulnerability is a logic flaw where DNS pinning was performed regardless of whether a trusted proxy was in use. This could be exploited by a malicious user providing a crafted path in a shared reply, which would then be resolved to a local file path and accessed by the application. The patch corrects this by ensuring that DNS pinning is bypassed when a trusted proxy is active, thereby mitigating the vulnerability. The test file changes in src/infra/net/fetch-guard.ssrf.test.ts further confirm this by adding a test case that verifies the corrected behavior in a trusted proxy scenario.

Vulnerable functions

fetchWithSsrFGuard

src/infra/net/fetch-guard.ts

The vulnerability lies in the `fetchWithSsrFGuard` function, which, prior to the patch, unconditionally performed DNS pinning by calling `resolvePinnedHostnameWithPolicy`. This occurred even when a trusted environment proxy was configured. An attacker could craft a shared reply with a specially crafted MEDIA path that, when resolved, would point to a local file. Because the proxy was considered trusted, the application would then access this local file, leading to a local file exfiltration vulnerability. The fix moves the call to `resolvePinnedHostnameWithPolicy` into the `else` block, ensuring that DNS pinning is skipped when a trusted proxy is in use, thus delegating the responsibility of hostname resolution to the proxy and preventing the local file access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.