GHSA-g2f6-pwvx-r275: OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection

March 16, 2026

openclaw versions <= 2026.3.12 accepted unsanitized iMessage remote attachment paths when staging files over SCP, allowing shell metacharacters in the remote path operand.

References

github.com/advisories/GHSA-g2f6-pwvx-r275
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/a54bf71b4c0cbe554a84340b773df37ee8e959de
github.com/openclaw/openclaw/security/advisories/GHSA-g2f6-pwvx-r275

Code Behaviors & Features

Detect and mitigate GHSA-g2f6-pwvx-r275 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →