GHSA-h3x4-hc5v-v2gm: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

March 26, 2026

Windows local-media handling accepted remote-host file URLs and UNC-style paths before local-path validation, so network-hosted file targets could be treated as local content.

References

github.com/advisories/GHSA-h3x4-hc5v-v2gm
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5
github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901
github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm

Code Behaviors & Features

Detect and mitigate GHSA-h3x4-hc5v-v2gm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →