https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:32:20 +0000 https://vulnerability.circl.lu/vuln/cve-2026-26321 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`. Upgrade to OpenClaw `2026.2.14` or newer to receive a fix. The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`. Upgrade to OpenClaw `2026.2.14` or newer to receive a fix. The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.</p> https://vulnerability.circl.lu/vuln/cve-2026-26321 https://vulnerability.circl.lu/vuln/ghsa-8jpq-5h99-ff5r <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary The Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly.</p> <p>### Affected versions - `&lt; 2026.2.14`</p> <p>### Patched versions - `&gt;= 2026.2.14`</p> <p>### Impact If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`.</p> <p>### Remediation Upgrade to OpenClaw `2026.2.14` or newer.</p> <p>### Notes The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.</p> <p>---</p> <p>Fix commit 5b4121d60 confirmed on main and in v2026.2.14. Upgrade to `openclaw &gt;= 2026.2.14`.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary The Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly.</p> <p>### Affected versions - `&lt; 2026.2.14`</p> <p>### Patched versions - `&gt;= 2026.2.14`</p> <p>### Impact If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`.</p> <p>### Remediation Upgrade to OpenClaw `2026.2.14` or newer.</p> <p>### Notes The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.</p> <p>---</p> <p>Fix commit 5b4121d60 confirmed on main and in v2026.2.14. Upgrade to `openclaw &gt;= 2026.2.14`.</p> https://vulnerability.circl.lu/vuln/ghsa-8jpq-5h99-ff5r