Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42424 Cross-Channel Local File Exfiltration in OpenClaw Before 2026.4.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42424
Post summary
The text announces CVE-2026-42424, a cross‑channel local file exfiltration flaw affecting OpenClaw versions older than 2026.4.8, with a link to the vulnerability details.
CVE-2026-42424 OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can explo… https://www.cve.org/CVERecord?id=CVE-2026-42424
Post summary
The text announces CVE-2026-42424 in OpenClaw, noting that shared reply MEDIA paths are mishandled, allowing local file exfiltration, but it offers no PoC, exploit, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |