https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 19:07:47 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-ghsa-jjgj-cpp9-cvpv <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>A malicious or compromised MCP (Model Context Protocol) tool server can exfiltrate arbitrary local files from the host system by injecting `MEDIA:` directives into tool result text content. OpenClaw&#39;s tool result processing pipeline extracts file paths from `MEDIA:` tokens without source-level validation, passes them through a `localRoots` allowlist check that includes `os.tmpdir()` by default (covering `/tmp` on Linux/macOS and `%TEMP%` on Windows), and then reads and delivers the file contents to external messaging channels such as Discord, Slack, Telegram, and WhatsApp.</p> <p>## Affected Component</p> <p>OpenClaw (all versions up to and including latest as of 2026-02-19)</p> <p>## Vulnerability Details</p> <p>### Root Cause</p> <p>The vulnerability exists across multiple files in the media processing pipeline:</p> <p>1. **Unvalidated extraction** (`src/agents/pi-embedded-subscribe.tools.ts`, lines 143-202): `extractToolResultMediaPaths()` parses `MEDIA:` tokens from MCP tool result text content blocks using a regex. It accepts **any** file path (absolute, relative, Windows drive, UNC, `file://` URI) without validating the source is trusted or the path is within expected boundaries.</p> <p>2. **Overly broad default allowlist** (`src/media/local-roots.ts`, lines 7-16): `buildMediaLocalRoots()` includes `os.tmpdir()` in the default allowed directory list. On Linux/macOS this is `/tmp` (world-readable, often containing application secrets, database dumps, SSH keys, session tokens), and on Windows it is `…</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>A malicious or compromised MCP (Model Context Protocol) tool server can exfiltrate arbitrary local files from the host system by injecting `MEDIA:` directives into tool result text content. OpenClaw&#39;s tool result processing pipeline extracts file paths from `MEDIA:` tokens without source-level validation, passes them through a `localRoots` allowlist check that includes `os.tmpdir()` by default (covering `/tmp` on Linux/macOS and `%TEMP%` on Windows), and then reads and delivers the file contents to external messaging channels such as Discord, Slack, Telegram, and WhatsApp.</p> <p>## Affected Component</p> <p>OpenClaw (all versions up to and including latest as of 2026-02-19)</p> <p>## Vulnerability Details</p> <p>### Root Cause</p> <p>The vulnerability exists across multiple files in the media processing pipeline:</p> <p>1. **Unvalidated extraction** (`src/agents/pi-embedded-subscribe.tools.ts`, lines 143-202): `extractToolResultMediaPaths()` parses `MEDIA:` tokens from MCP tool result text content blocks using a regex. It accepts **any** file path (absolute, relative, Windows drive, UNC, `file://` URI) without validating the source is trusted or the path is within expected boundaries.</p> <p>2. **Overly broad default allowlist** (`src/media/local-roots.ts`, lines 7-16): `buildMediaLocalRoots()` includes `os.tmpdir()` in the default allowed directory list. On Linux/macOS this is `/tmp` (world-readable, often containing application secrets, database dumps, SSH keys, session tokens), and on Windows it is `…</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-ghsa-jjgj-cpp9-cvpv