https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:07:58.963947+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-35658 CVE-2026-35658 — OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool 2026-10-03T12:07:59.015957+00:00

Affected: OpenClaw

OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.

 https://cve.radiocsirt.org/vuln/ghsa-cfp9-w5v9-3q4h GHSA-cfp9-w5v9-3q4h — OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts 2026-10-03T12:07:59.016066+00:00

Affected: npm: openclaw

## Summary The `image` tool did not fully honor the `tools.fs.workspaceOnly` filesystem boundary. In affected releases, image-path resolution could still traverse sandbox bridge mounts outside the workspace and read files from mounted directories that the other file tools would reject.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `< 2026.3.2` - Fixed: `>= 2026.3.2` - Latest released tags checked: `v2026.3.23` (`ccfeecb6887cd97937e33a71877ad512741e82b2`) and `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s) - `dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53` - `14baadda2c456f3cf749f1f97e8678746a34a7f4`

## Release Status The complete fix shipped in `v2026.3.2` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation - `src/agents/openclaw-tools.ts` now passes `fsPolicy` into `createImageTool`, so the image tool receives the same workspace-only policy input as the other filesystem tools. - `src/agents/tools/image-tool.ts`, `src/agents/tools/media-tool-shared.ts`, and `src/agents/sandbox-media-paths.ts` now restrict local roots and sandbox-bridge resolution to the workspace when `tools.fs.workspaceOnly` is enabled.

OpenClaw thanks @YLChen-007 for reporting.