Is there a patch available for CVE-2026-42424?

Yes, a patch is available for CVE-2026-42424. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-42424

Q: What is the CVSS score of CVE-2026-42424?

CVE-2026-42424 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26127 MEDIUM

External Control of File Name or Path (CWE-73)

2026-04-28 VulnCheck

Information Disclosure Openclaw

5.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

AC:H captures cross-channel attack prerequisites (AT:P in CVSS 4.0); UI:R for passive victim channel processing; no integrity or availability impact observed.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:17 vuln.today

Analysis Generated

Jul 24, 2026 - 04:17 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.7 (MEDIUM) 5.9 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26127

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:10 nvd

MEDIUM 5.9

DescriptionCVE.org

OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media.

AnalysisAI

Cross-channel local file exfiltration in OpenClaw (npm package, all versions before 2026.4.8) allows an attacker with low-privilege access to craft malicious shared reply MEDIA path references that cause a separate channel to resolve and expose local file contents as trusted generated media. The root cause (CWE-73) is improper neutralization of path references in shared reply MEDIA URIs: OpenClaw accepts these references without enforcing a trust origin check, effectively treating attacker-controlled paths as internally generated content. No public exploit code has been identified and CISA has not listed this in KEV, but the high confidentiality impact on the vulnerable system (VC:H in the CVSS 4.0 vector) and the arbitrary local-file-read capability make patching a priority for any affected deployment.

Technical ContextAI

OpenClaw is a user-controlled local AI assistant distributed as an npm package (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-73 (External Control of File Name or Path), where the application accepts MEDIA: URI paths embedded in shared reply objects without validating whether those paths originated from a trusted, internally generated source. When a shared reply carries a crafted MEDIA reference, OpenClaw's inter-channel content sharing mechanism resolves the path against the local filesystem as if it were trusted output - surfacing arbitrary file contents to the requesting channel. The flaw is architectural: the trust boundary between channels is not enforced at the point where MEDIA path references are consumed, allowing one channel's crafted input to drive file-system reads that appear in another channel's context.

RemediationAI

Upgrade the openclaw npm package to version 2026.4.8 or later using npm install openclaw@2026.4.8 or npm update openclaw; this is the vendor-released patch confirmed by GHSA-qqq7-4hxc-x63c (https://github.com/openclaw/openclaw/security/advisories/GHSA-qqq7-4hxc-x63c). The verified fixed commit on the main branch is d7c3210cd6f5fdfdc1beff4c9541673e814354d5. If immediate upgrade is not feasible, restrict shared reply functionality to fully trusted sources only and avoid processing shared replies from untrusted third parties, since the crafted MEDIA reference must be delivered via the shared reply mechanism to trigger the file read. Note that disabling shared reply ingestion entirely would prevent exploitation but also removes cross-channel content sharing functionality.