GHSA-2mc2-g238-722j: OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

Remote iMessage attachment fetches used SCP with trust-on-first-use host-key behavior and accepted unvalidated remote host tokens.

Before the fix:

  • SCP used StrictHostKeyChecking=accept-new in the remote attachment path.
  • channels.imessage.remoteHost was not validated as a strict SSH host token.

References

Code Behaviors & Features

Detect and mitigate GHSA-2mc2-g238-722j with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →