CVE-2026-43532CWE-184

OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image

Medium · published May 5, 2026

CVSS v4.0
4.9
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media.

The record
Technical detail
CVSS v4.0
4.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-05-05T11:25Z
EPSS history
Timeline
  • 05 MAY 11:25Z
    OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image
    cvelistv5