漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard
Vulnerability Description
OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:// URLs. Attackers can exploit this by accessing local files readable by the OpenClaw process user through browser snapshot and extraction actions to exfiltrate sensitive data.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
资源在另一范围的外部可控制索引
Vulnerability Title
OpenClaw 安全漏洞
Vulnerability Description
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.2.21之前版本存在安全漏洞，该漏洞源于assertBrowserNavigationAllowed函数中的URL方案验证不当问题，可能导致通过执行浏览器快照及提取操作，访问 OpenClaw 进程用户可读取的本地文件，从而窃取敏感数据。
CVSS Information
N/A
Vulnerability Type
N/A