Summary
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
In sandboxed runs, native prompt image auto-load did not honor tools.fs.workspaceOnly=true.
This optional hardening setting is not enabled by default. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example /agent/secret.png) and load those image bytes for vision-capable model input.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version at triage time:
2026.2.23 - Vulnerable version range:
<= 2026.2.23 - Patched version (planned next release):
2026.2.24
Conditions Required
This issue required all of the following:
- sandbox mode enabled,
tools.fs.workspaceOnly=trueconfigured,- an out-of-workspace mount path reachable from the sandbox (for example
/agent), - vision-capable model path active for native prompt image loading.
Technical Details
Native prompt image ingestion (detectAndLoadPromptImages / loadImageFromRef) resolved and read sandbox paths but did not apply the same workspace-root assertion used by file tools when tools.fs.workspaceOnly was set.
Fix Commit(s)
370d115549c0dadace0902775eea0d5094aedfdc
Verification
pnpm checkpnpm exec vitest run --config vitest.gateway.config.tspnpm test:fast
Release Process Note
patched_versions is pre-set to the planned next release (2026.2.24) so once npm release is available, this advisory only needs publish action.
OpenClaw thanks @tdjackey for reporting.
Publication Update (2026-02-25)
[email protected] is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.
Impact
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-9F72-QCPW-2HXC? GHSA-9F72-QCPW-2HXC is a high-severity security vulnerability in openclaw (npm), affecting versions <= 2026.2.23. It is fixed in 2026.2.24.
- Which versions of openclaw are affected by GHSA-9F72-QCPW-2HXC? openclaw (npm) versions <= 2026.2.23 is affected.
- Is there a fix for GHSA-9F72-QCPW-2HXC? Yes. GHSA-9F72-QCPW-2HXC is fixed in 2026.2.24. Upgrade to this version or later.
- Is GHSA-9F72-QCPW-2HXC exploitable, and should I be worried? Whether GHSA-9F72-QCPW-2HXC is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-9F72-QCPW-2HXC is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-9F72-QCPW-2HXC? Upgrade
openclawto 2026.2.24 or later.