GHSA-jjgj-cpp9-cvpv: OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
SummaryA malicious or compromised MCP (Model Context Protocol) tool server can exfiltrate arbitrary local files from the host system by injecting `MEDIA:` directives into tool result text content. OpenClaw's tool result processing pipeline extracts file paths from `MEDIA:` tokens without source-level validation, passes them through a `localRoots` allowlist check that includes `os.tmpdir()` by default (covering `/tmp` on Linux/macOS and `%TEMP%` on Windows), and then reads and delivers the file contents to external messaging channels such as Discord, Slack, Telegram, and WhatsApp.Affected ComponentOpenClaw (all versions up to and including latest as of 2026-02-19)Vulnerability DetailsRoot CauseThe vulnerability exists across multiple files in the media processing pipeline:**Unvalidated extraction** (`src/agents/pi-embedded-subscribe.tools.ts`, lines 143-202): `extractToolResultMediaPaths()` parses `MEDIA:` tokens from MCP tool result text content blocks using a regex. It accepts **any** file path (absolute, relative, Windows drive, UNC, `file://` URI) without validating the source is trusted or the path is within expected boundaries.**Overly broad default allowlist** (`src/media/local-roots.ts`, lines 7-16): `buildMediaLocalRoots()` includes `os.tmpdir()` in the default allowed directory list. On Linux/macOS this is `/tmp` (world-readable, often containing application secrets, database dumps, SSH keys, session tokens), and on Windows it is `%TEMP%` (user's temp directory containing application caches, credentials, and temporary secrets).**Delivery to external channels** (`src/agents/pi-embedded-subscribe.handlers.tools.ts`, lines 380-392): After extraction, media paths are delivered via `ctx.params.onToolResult({ mediaUrls: mediaPaths })`, which flows through the outbound delivery pipeline to send file contents as attachments to Discord, Slack, Telegram, and other configured messaging channels.Attack FlowSecondary Attack Vector: `details.path` FallbackWhen an MCP tool result contains `type: "image"` content blocks, `extractToolResultMediaPaths()` falls back to reading `result.details.path` (lines 192-199). A malicious tool can return:This bypasses the `MEDIA:` token parsing entirely and directly injects arbitrary file paths.Third Attack Vector: `file://` URI SchemeThe `loadWebMediaInternal()` function (line 228-233) converts `file://` URIs to local paths via `fileURLToPath()`:This provides an alternative syntax for targeting files.Impact**File exfiltration**: Any file within `os.tmpdir()` (or the OpenClaw state directory) can be read and sent to external messaging channels**Secret theft**: Temporary files often contain API keys, database credentials, SSH keys, session tokens, and application secrets**Cross-application data theft**: Other applications' temp files (browser caches, build artifacts, CI/CD secrets) are accessible**Silent exfiltration**: The file content is sent as a media attachment to messaging channels the attacker can monitor, with no user-visible indication**Automated exploitation**: If auto-reply is enabled, the malicious tool can be triggered without user interactionReproduction StepsPrerequisitesNode.js 18+ installedNo OpenClaw installation required (PoC is self-contained)StepsSave the PoC script below as `poc-media-exfil.js`Run: `node poc-media-exfil.js`Observe: All 21 assertions pass, confirming the vulnerabilityPoC ScriptExpected OutputAffected Code Locations| File | Lines | Function | Role |
|------|-------|----------|------|
| `src/media/parse.ts` | 7 | `MEDIA_TOKEN_RE` | Regex that matches `MEDIA:` directives in text |
| `src/agents/pi-embedded-subscribe.tools.ts` | 143-202 | `extractToolResultMediaPaths()` | Extracts file paths from MCP tool results without source validation |
| `src/agents/pi-embedded-subscribe.handlers.tools.ts` | 380-392 | `handleToolExecutionEnd()` | Delivers extracted media paths to messaging channels |
| `src/media/local-roots.ts` | 7-16 | `buildMediaLocalRoots()` | Includes `os.tmpdir()` in default allowed roots |
| `src/web/media.ts` | 60-117 | `assertLocalMediaAllowed()` | Validates paths against overly broad `localRoots` |
| `src/web/media.ts` | 212-381 | `loadWebMediaInternal()` | Reads validated files into memory for delivery |Suggested Remediation**Validate MEDIA: source trust**: Only accept `MEDIA:` directives from OpenClaw's own internal tools (TTS, image generation). Reject or flag `MEDIA:` directives from external MCP tool results.**Remove `os.tmpdir()` from default localRoots**: The temp directory is too broad. Replace with a narrow OpenClaw-specific subdirectory (e.g., `path.join(os.tmpdir(), "openclaw-media")`).**Add source tagging to tool results**: Tag each tool result with its source (internal vs. MCP external) and enforce different media access policies for each.**Require explicit opt-in for file media delivery**: When a tool result contains `MEDIA:` directives referencing local files, require user confirmation before reading and sending the file.Differentiation from Existing AdvisoriesThis vulnerability is **distinct** from all existing OpenClaw security advisories. Below is an explicit comparison against every advisory or commit that could appear superficially related:Not a duplicate of path traversal advisories (apply-patch, workspace escape, etc.)The existing path traversal advisories (e.g., those targeting `apply-patch` tool workspace containment via `assertSandboxPath()`, or `resolveFileWithinRoot()` in the canvas host file resolver) are about **preventing filesystem access outside a sandbox boundary**. This vulnerability is fundamentally different:**Different attack surface**: The attack enters through **MCP tool result text content** (`extractToolResultMediaPaths()` in `pi-embedded-subscribe.tools.ts`), not through tool arguments, HTTP paths, or patch file contents.**Different code path**: The vulnerable pipeline is `extractToolResultMediaPaths()` → `handleToolExecutionEnd()` → `onToolResult()` → `loadWebMedia()` → `assertLocalMediaAllowed()`. None of these functions are involved in the existing path traversal fixes.**The validation passes by design**: This is not a bypass of `assertLocalMediaAllowed()`. The function works correctly. The problem is that `os.tmpdir()` is included in the default `localRoots` allowlist (`src/media/local-roots.ts:10`), making the entire system temp directory readable by any MCP tool that returns a `MEDIA:` directive.Not a duplicate of SSRF advisoriesThe existing SSRF advisories cover `fetchWithSsrFGuard()` and `resolvePinnedHostnameWithPolicy()` in `src/infra/net/`. This vulnerability does not involve any HTTP fetching or DNS resolution. Instead, it reads **local files** from disk and delivers them outbound to messaging channels. The `MEDIA:` path is a local filesystem path, not a URL.Not a duplicate of canvas host file disclosureThe canvas host file disclosure advisory covers the HTTP serving side (`resolveFileWithinRoot()` in `src/canvas-host/file-resolver.ts`), where path traversal in the URL could escape the canvas root directory. This vulnerability is about **outbound** file exfiltration through the agent messaging pipeline, not about the canvas host HTTP server.Not a duplicate of inbound attachment root policy (`1316e57`)Commit `1316e57` ("enforce inbound attachment root policy across pipelines") added `src/media/inbound-path-policy.ts` to restrict **inbound** media paths from messaging channels (e.g., iMessage attachment roots). This vulnerability is about **outbound** media delivery, where files are read from disk and sent to external channels via `MEDIA:` directives in MCP tool results. Different direction, different code, different policy layer.Not a duplicate of any webhook/messaging auth bypassThe webhook auth bypass and messaging platform allowlist bypass advisories cover authentication between OpenClaw and external services. This vulnerability assumes the MCP tool is already configured and trusted. The issue is that tool results can inject `MEDIA:` directives that cause unintended local file reads and exfiltration.Verification: zero prior fixes for this code pathA `git log` search for commits touching `localRoots`, `local-roots`, `tmpdir`, or `extractToolResultMediaPaths` returns **zero results**, confirming this vulnerability has never been reported or addressed.ResourcesOpenClaw MCP tool integration documentation[OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)[CWE-22: Improper Limitation of a Pathname to a Restricted Directory](https://cwe.mitre.org/data/definitions/22.html)[CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](https://cwe.mitre.org/data/definitions/200.html)Credit**Anmol Vats** ([@NucleiAv](https://github.com/NucleiAv))
CVSS v4.0: 6.9