| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
The Zalo image path fetched and stored inbound media before the DM/pairing authorization checks ran.
Unauthorized senders could force network fetches and disk writes in the inbound media store even when the message itself was rejected.
extensions/zalo/src/monitor.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 68ceaf7a5f (zalo: gate image downloads before DM auth).
OpenClaw thanks @AntAISecurityLab for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free