• Directory traversal in src/gateway/canvas-documents.ts (resolveCanvasHttpPathToLocalPath): documentId is not validated with normalizeCanvasDocumentId before path.join, allowing .. as a document ID to escape the canvas documents directory. Reachable both via HTTP canvas paths and from agent-generated MEDIA: references in src/media/web-media.ts.
• Canvas capability broadened to all WS clients (src/gateway/server/http-auth.ts): the isNodeWsClient guard was removed, meaning any authenticated WebSocket client (including browser clients) can now authorize canvas iframe content serving. This is an intentional change per the PR, but widens the trust surface for capability establishment.

Description

The new trusted embed sandbox mode returns allow-scripts allow-same-origin, which removes the key sandbox protection that forces the iframe into an opaque origin.

When this mode is enabled via Control UI bootstrap config, canvas previews are rendered in an <iframe> with this sandbox value (e.g. in the markdown sidebar). Because the iframe src is resolved to same-origin paths under /__openclaw__/canvas/... (see resolveCanvasIframeUrl sanitization), any HTML/JS served from those canvas document endpoints will execute as the same origin as the Control UI.

This becomes a stored-XSS style escalation if an attacker can influence canvas document HTML (e.g. via tool outputs / assistant-generated HTML bundles written by createCanvasDocument):

• input: assistant/tool-controlled canvas document HTML (createCanvasDocument(... entrypoint.type === "html" ...) writes raw HTML)
• sink: iframe sandbox includes allow-same-origin in trusted mode
• impact: iframe JS can read same-origin data (cookies/localStorage), access parent DOM via window.parent, and perform authenticated actions.

Vulnerable code:

case "trusted":
  return "allow-scripts allow-same-origin";

Recommendation

Avoid allow-same-origin for content that can be influenced by assistants/tools/users.

Safer options:

1. Remove same-origin entirely and keep isolation:

case "trusted":
  ​// still allow scripts, but keep unique origin isolation
  return "allow-scripts";

2. If same-origin is required for a subset of truly trusted, static content, gate it behind strict allowlisting and/or serve trusted canvas content from a separate origin (e.g., canvas.example.com) without access to Control UI cookies/storage.

3. Add prominent documentation/warnings and default to scripts/strict for all deployments.

Description

The new GET /__openclaw__/assistant-media?source=... endpoint validates that the requested path is under an allowed root using assertLocalMediaAllowed(), but then opens the path with openLocalFileSafely() which does not reject hardlinks.

An attacker who can create a hardlink inside any allowed media root (e.g., a workspace or state/media directory) pointing to a sensitive file elsewhere on the filesystem can then request the hardlink path via this endpoint and have the gateway stream the target file contents.

Why this is exploitable:

• assertLocalMediaAllowed() checks only the resolved pathname prefix against allowed roots; hardlinks preserve the pathname and do not involve symlinks, so the check still passes.
• openLocalFileSafely() wraps openVerifiedLocalFile() without rejectHardlinks, and openVerifiedLocalFile() explicitly only checks stat.nlink when rejectHardlinks is enabled.

Vulnerable code paths:

• authorization/allowlist check: assertLocalMediaAllowed(source, getDefaultLocalRoots())
• sink (file open + streaming): openLocalFileSafely({ filePath: source })

Recommendation

Reject hardlinks (and ideally enforce root containment at open time) for this endpoint.

Option A (minimal change): add a hardlink rejection check after opening:

const opened = await openLocalFileSafely({ filePath: source });
if (opened.stat.nlink > 1) {
  await opened.handle.close().catch(() => {});
  throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
}

Option B (preferred): introduce an openLocalFileSafely({ filePath, rejectHardlinks: true }) mode (or a dedicated helper) and use it here.

Also consider folding the allowlist check into the open operation (e.g., by opening via a root-aware function) to avoid TOCTOU between allowlist verification and open.

Description

getAgentScopedMediaLocalRootsForSources now expands the allowlist of local-readable directories based on mediaSources values (paths/URLs) present in outbound actions/payloads.

• Input (attacker-influenced): mediaSources is collected from outbound tool/action parameters (mediaUrl, path, filePath, fileUrl, etc.) and outbound payload mediaUrls (which can be influenced by untrusted chat users via prompt injection/social engineering).
• Security decision: appendLocalMediaParentRoots adds the parent directory of each absolute path / file:// URL / ~ path to the localRoots allowlist.
• Impact: Once a parent directory is added, downstream local media loading (via assertLocalMediaAllowed + readLocalFileSafely in loadWebMedia) can read arbitrary local files under that directory and send them out as “media”. This enables local file inclusion / data exfiltration of sensitive host files (e.g., ~/.ssh/*, browser cookies, /etc/*, etc.) whenever root expansion is allowed by policy.

Vulnerable code:

for (const source of mediaSources ?? []) {
  const localPath = resolveLocalMediaPath(source);
  ...
  const parentDir = path.dirname(localPath);
  ...
  appended.push(path.resolve(parentDir));
}

Even though filesystem root (/ or drive root) is blocked, adding directories like /Users/<name> or ~’s parent is still a significant widening of access compared to the managed media cache/workspace roots.

Recommendation

Do not widen localRoots based on untrusted mediaSources.

Safer options:

1. Remove root expansion entirely (preferred): keep allowlist limited to managed media cache + agent workspace.

2. If you must support referencing arbitrary local files, gate it behind explicit user approval or a separate high-trust capability, and restrict expansions to the agent workspace only.

Example: only allow expansion when the resolved parent is inside the workspace root:

export function appendLocalMediaParentRoots(
  roots: readonly string[],
  mediaSources: readonly string[] | undefined,
  workspaceRoot: string,
): string[] {
  const appended = Array.from(new Set(roots.map((r) => path.resolve(r))));
  for (const source of mediaSources ?? []) {
    const localPath = resolveLocalMediaPath(source);
    if (!localPath) continue;
    const parent = path.resolve(path.dirname(localPath));
    const rel = path.relative(workspaceRoot, parent);
    if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) continue;
    if (!appended.includes(parent)) appended.push(parent);
  }
  return appended;
}

Also consider rejecting ~ expansion here, and require sandbox-validated reads (sandboxValidated + readFile override) instead of expanding localRoots.

Description

createCanvasDocument() can generate an index.html PDF wrapper for entrypoint.type === "url" when kind === "document" and the URL ends with .pdf.

• The wrapper embeds the provided entrypoint.value directly into <object data>, <iframe src>, and <a href>.
• The value is only HTML-escaped; there is no URL scheme validation.
• An attacker who can influence entrypoint.value can supply a dangerous scheme that still matches the .pdf regex (e.g. javascript:...pdf, data:text/html,...pdf).
• When the wrapper is loaded in the UI canvas iframe, the sandbox mode typically includes allow-scripts (and may include allow-same-origin in trusted mode). This enables attacker-controlled script execution inside the wrapper context.

Vulnerable code:

function isPdfPathLike(value: string): boolean {
  return /\.pdf(?:[?#].*)?$/i.test(value.trim());
}

function buildPdfWrapper(url: string): string {
  const escaped = escapeHtml(url);
  return `...<object data="${escaped}" ...><iframe src="${escaped}" ...></iframe>...`;
}

Recommendation

Validate and restrict the allowed URL schemes before generating the wrapper.

For example, only allow http: and https: URLs for entrypoint.type === "url" (and optionally relative/absolute http(s) URLs), and reject/ignore javascript:, data:, file:, etc.

function assertSafeExternalPdfUrl(raw: string): string {
  const url = new URL(raw);
  if (url.protocol !== "http:" && url.protocol !== "https:") {
    throw new Error("Unsupported PDF URL scheme");
  }
  return url.toString();
}

if (entrypoint.type === "url" && input.kind === "document" && isPdfPathLike(entrypoint.value)) {
  const safePdfUrl = assertSafeExternalPdfUrl(entrypoint.value);
  await fs.writeFile(path.join(rootDir, "index.html"), buildPdfWrapper(safePdfUrl), "utf8");
  ...
}

Additionally consider adding a restrictive CSP to canvas-served HTML wrappers (e.g., disallow object/frame to non-HTTP(S) origins), or avoid generating wrappers that embed arbitrary external URLs at all.

Description

The gateway's canvas host protection was weakened from node-only to any connected WS client, and the WS handshake now mints a canvas capability token for any client when canvasHostUrl is present.

This creates a broken-access-control condition:

• attachGatewayWsMessageHandler mints a canvasCapability for webchat/operator clients (not just node clients).
• authorizeCanvasRequest accepts the oc_cap capability as a standalone authorization mechanism (no bearer token required), and no longer checks client type/role.
• The capability is a bearer secret embedded in URLs (/__openclaw__/cap/<cap>/... or ?oc_cap=). For browser-based clients (webchat/control UI), this can be leaked via Referer headers to third-party subresources or used in CSRF-style requests from untrusted embedded content.

Vulnerable behavior is visible in the changed code:

​// ws handshake: capability minted for any client
const canvasCapability = canvasHostUrl ? mintCanvasCapabilityToken() : undefined;
...
canvasHostUrl: scopedCanvasHostUrl,

​// http auth: capability accepted if any WS client has it
if (canvasCapability && hasAuthorizedWsClientForCanvasCapability(clients, canvasCapability)) {
  return { ok: true };
}

Impact depends on what the canvas host exposes, but at minimum it allows any authorized browser WS client to obtain a capability URL that bypasses normal HTTP bearer-token auth for the canvas routes, and the capability can be replayed by any party who learns it within its TTL (with sliding renewal).

Recommendation

Re-establish a strict trust boundary for canvas-host access.

Options (choose one consistent with the intended threat model):

1. If canvas host must remain node-only (previous model):
   • Only mint canvasCapability for trusted node clients.
   • Only accept oc_cap if the matching capability belongs to a node client.

​// ws handshake
const canvasCapability = role === "node" && canvasHostUrl ? mintCanvasCapabilityToken() : undefined;

​// http-auth: ensure capability belongs to a node client
if (canvasCapability && hasAuthorizedNodeWsClientForCanvasCapability(clients, canvasCapability)) {
  return { ok: true };
}

2. If browser clients must access canvas, avoid URL-bearer capability tokens:
   • Bind capability to the requesting session (e.g., gateway session id / auth generation) and require the normal gateway bearer token on every request, or issue an HttpOnly cookie scoped to the canvas path.
   • Add CSRF protections for any state-changing endpoints.
   • Ensure Referrer-Policy: no-referrer (or at least same-origin) on canvas responses if URL tokens remain.

Also consider removing sliding renewal or additionally binding the capability to the specific WS connId and enforcing that the HTTP request originates from the same authenticated principal.

Description

createCanvasDocument materializes canvas documents by copying an entrypoint and optional assets into the managed canvas documents directory. For both entrypoint.type:"path" and assets[].sourcePath, the implementation allows:

• absolute paths (/etc/passwd)
• ~-expanded paths (home directory)

and then copies the referenced host file into the canvas document directory.

If an attacker (LLM/agent output, plugin, or other untrusted caller) can influence CanvasDocumentCreateInput (document entrypoint.value or assets[].sourcePath), they can exfiltrate arbitrary readable host files by copying them into a location intended to be served under /__openclaw__/canvas/documents/<id>/....

Vulnerable code:

const sourcePath = asset.sourcePath.startsWith("~")
  ? resolveUserPath(asset.sourcePath)
  : path.isAbsolute(asset.sourcePath)
    ? path.resolve(asset.sourcePath)
    : path.resolve(workspaceDir, asset.sourcePath);
...
await fs.copyFile(sourcePath, destination);

and:

const resolvedPath = entrypoint.value.startsWith("~")
  ? resolveUserPath(entrypoint.value)
  : path.isAbsolute(entrypoint.value)
    ? path.resolve(entrypoint.value)
    : path.resolve(workspaceDir, entrypoint.value);
...
await fs.copyFile(resolvedPath, path.join(rootDir, fileName));

Recommendation

Restrict what host paths can be copied into canvas documents.

Recommended approach:

• Default-deny absolute and ~ paths; only allow workspace-relative paths.
• If you need to support reading outside the workspace, gate it behind an explicit capability/policy (similar to existing local media access/root expansion policies), and validate against an allowlist of roots.
• Additionally, consider rejecting symlinks when copying.

Example hardening (workspace-only):

function resolveWorkspaceOnlyPath(workspaceDir: string, inputPath: string): string {
  if (inputPath.startsWith("~") || path.isAbsolute(inputPath)) {
    throw new Error("absolute paths are not allowed");
  }
  const candidate = path.resolve(workspaceDir, inputPath);
  const workspaceRoot = path.resolve(workspaceDir);
  if (!(candidate === workspaceRoot || candidate.startsWith(workspaceRoot + path.sep))) {
    throw new Error("path escapes workspace");
  }
  return candidate;
}

const resolvedPath = resolveWorkspaceOnlyPath(workspaceDir, entrypoint.value);
await fs.copyFile(resolvedPath, path.join(rootDir, path.basename(resolvedPath)));

If non-workspace roots are required, replace the workspace check with an allowlisted roots check (e.g., isWithinDir(allowedRoot, candidate) for each allowed root).

Description

The chat view maintains per-session caches for tool-card expansion state (expandedToolCardsBySession, initializedToolCardsBySession). While the outer maps are limited by MAX_CACHED_CHAT_SESSIONS, the inner Map/Set for a single active session can grow without bound because IDs are only ever added and never removed.

In syncToolCardExpansionState:

• Disclosure IDs are generated per tool card (${entry.key}:toolcard:${cardIndex}) and per tool message (toolmsg:${entry.key})
• Each ID is added to initialized/expanded the first time it is seen
• There is no pruning of IDs when messages/tool cards are deleted, when history is compacted, or when IDs change due to re-keying

An attacker-controlled prompt/tool output (or simply a very large/long-running session) that causes many tool cards/messages can make these caches grow indefinitely, degrading UI performance or exhausting memory (availability impact).

Recommendation

Prune per-session expansion caches to the current message set (or cap their size) so they cannot grow without bound.

Example: after collecting currentToolCardIds, remove stale entries:

for (const key of expanded.keys()) {
  if (!currentToolCardIds.has(key)) expanded.delete(key);
}
for (const key of initialized.keys()) {
  if (!currentToolCardIds.has(key)) initialized.delete(key);
}

Also consider:

• Clearing per-session tool-card caches when the user clears history / deletes a session
• Using a bounded LRU per session (e.g., limit to last N tool cards) to prevent pathological growth even when messages are retained

Description

The Control UI generates assistant-media URLs that embed the gateway authentication token as a token query parameter. This token is derived from settings.token or the UI password, and is then sent in requests for images/audio/video/document links.

Why this is a problem:

• Query-string secrets commonly leak via browser history, copy/paste, server access logs, proxy logs, and can be forwarded in some contexts.
• The server explicitly supports reading the token from the query string, reinforcing the unsafe pattern.
• The assistant-media response sets Cache-Control: no-cache (not no-store), which does not reliably prevent storage by intermediaries or browsers.

Vulnerable code (client):

const params = new URLSearchParams({ source });
const normalizedToken = authToken?.trim();
if (normalizedToken) {
  params.set("token", normalizedToken);
}
return `${normalizedBasePath}/__openclaw__/assistant-media?${params.toString()}`;

Vulnerable code (server accepts query token):

const url = new URL(urlRaw, "http://localhost");
const token = url.searchParams.get("token")?.trim();
return token || undefined;

Recommendation

Avoid placing authentication tokens in URLs.

Preferred fix:

1. Remove the token query parameter from buildAssistantAttachmentUrl().
2. Send the token using an Authorization header (Bearer) instead.
   • For media displayed in <img>/<audio>/<video> where setting headers is hard, use one of:
     • A short-lived, one-time, signed URL (not the long-lived gateway token), OR
     • A same-origin HttpOnly cookie session for control-ui, OR
     • Fetch the media as a Blob with fetch(..., {headers:{Authorization: ...}}) and then set src to URL.createObjectURL(blob).
3. For responses from handleControlUiAssistantMediaRequest, set strict cache controls:

res.setHeader("Cache-Control", "no-store");
res.setHeader("Pragma", "no-cache");

And consider adding:

res.setHeader("Referrer-Policy", "no-referrer");

Server hardening: stop accepting token from req.url (query string) and only accept Authorization: Bearer ... (or cookie/session).

Description

Tool-result messages are scanned for a canvas preview and, if found, the UI injects a {type:"canvas"} block into the nearest assistant message.

This preview is derived from tool-controlled output text via extractToolPreview()/extractCanvasFromText() (JSON parsing) and then rendered as an <iframe>.

Key concerns:

• No allowlist of tool names / trust boundary: any tool that can emit a tool-result message can craft JSON like {"kind":"canvas","view":{"url":"/__openclaw__/a2ui/..."}} and cause an iframe preview to appear inside assistant messages.
• The URL is later sanitized to same-origin /__openclaw__/canvas or /__openclaw__/a2ui, but this still allows an untrusted tool to embed internal app routes in an iframe, enabling UI redress/phishing or disclosure of any GET-accessible internal content to the user.

Vulnerable code (lifting the preview from tool output into assistant message content):

const preview = extractToolPreview(text, toolName);
...
items[assistantIndex] = {
  ...item,
  message: appendCanvasBlockToAssistantMessage(
    item.message as Record<string, unknown>,
    liftedCanvasSource.preview,
    liftedCanvasSource.text,
  ),
};

Recommendation

Treat tool-result output as untrusted and do not allow it to create renderable iframe previews unless the tool is explicitly trusted.

Suggested hardening (defense-in-depth):

1. Allowlist tool names that are permitted to produce canvas previews (e.g., only canvas_render), and ignore previews from all other tool results.
2. Further constrain preview URLs to the minimal required subset (for example only /__openclaw__/canvas/documents/<docId>/index.html), rejecting /__openclaw__/a2ui/** unless absolutely needed.
3. Consider using a stricter sandbox by default (e.g. embedSandboxMode="strict") for previews originating from tool output.

Example (allowlist check before lifting):

const TRUSTED_PREVIEW_TOOLS = new Set(["canvas_render"]);
...
if (!toolName || !TRUSTED_PREVIEW_TOOLS.has(toolName)) return null;
const preview = extractToolPreview(text, toolName);

Description

/__/openclaw/control-ui-config.json (Control UI bootstrap) is served without any authentication check, but now includes localMediaPreviewRoots derived from getDefaultLocalRoots().

• Input/trigger: Any unauthenticated HTTP client can request the bootstrap JSON.
• Data exposed: Absolute host paths for OpenClaw config/state/workspace directories (and temp dir), which can reveal usernames, directory layout, mount points, etc.
• Why this matters: This increases attacker reconnaissance and can aid follow-on attacks (targeted file probing, privilege escalation attempts, environment fingerprinting). The exposure is new in this diff because localMediaPreviewRoots was added to the bootstrap response.

Vulnerable code:

sendJson(res, 200, {
  ...
  localMediaPreviewRoots: [...getDefaultLocalRoots()],
  embedSandbox: ...,
});

Recommendation

Avoid exposing host filesystem paths to unauthenticated clients.

Options:

1. Remove localMediaPreviewRoots from the unauthenticated bootstrap response (preferred), and instead hardcode UI behavior or fetch roots only after an authenticated connection.
2. If it must be returned, gate the bootstrap endpoint behind gateway auth (or a separate Control UI auth mechanism) and/or return redacted roots (e.g., only labels like "workspace", "tmp").

Example (omit paths):

sendJson(res, 200, {
  ...,
  ​// Do not reveal absolute paths
  localMediaPreviewRoots: [],
});

Or (auth gate):

if (opts?.auth) {
  const requestAuth = await authorizeGatewayHttpRequestOrReply({ ... });
  if (!requestAuth) return true;
}