https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T19:32:21.521988+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-26321 CVE-2026-26321 — OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension 2026-10-04T19:32:21.524591+00:00

Affected: openclaw

OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`. Upgrade to OpenClaw `2026.2.14` or newer to receive a fix. The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.

 https://vulnerability.circl.lu/vuln/ghsa-8jpq-5h99-ff5r GHSA-8jpq-5h99-ff5r — OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension 2026-10-04T19:32:21.524692+00:00

Affected: npm: openclaw

### Summary The Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly.

### Affected versions - `< 2026.2.14`

### Patched versions - `>= 2026.2.14`

### Impact If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`.

### Remediation Upgrade to OpenClaw `2026.2.14` or newer.

### Notes The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.

---

Fix commit 5b4121d60 confirmed on main and in v2026.2.14. Upgrade to `openclaw >= 2026.2.14`.