| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | ≥ 2026.2.6, < 2026.3.28 | 2026.3.28 |
| openclaw | ≥ 2026.2.6, < 2026.3.28 | 2026.3.28 |
Feishu upload path resolution could read files outside the configured localRoots sandbox before handing them to the upload path.
A tool caller constrained to workspace or localRoots paths could exfiltrate arbitrary host files through Feishu upload actions.
extensions/feishu/src/docx.ts
>= 2026.2.6, <= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 764394c78b (fix: enforce localRoots sandbox on Feishu docx upload file reads).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free