{"answers":{"affected":"2 open source packages ship an affected version, including openclaw.","exploited":"There is no known exploitation of GHSA-w5c7-9qqw-6645 in the wild and no public exploit code.","fix":"Upgrade openclaw to 2026.2.13 or later.","what":"GHSA-w5c7-9qqw-6645 is a vulnerability in openclaw, published on 18 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-w5c7-9qqw-6645 and fix it if it is affected.\n\nWhat it is: GHSA-w5c7-9qqw-6645 is a vulnerability in openclaw, published on 18 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-w5c7-9qqw-6645 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- openclaw (npm): affected all versions; fixed in 2026.2.13\n- openclaw (npm): affected all versions; fixed in 2026.2.13\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-w5c7-9qqw-6645/ (Markdown: https://insights.sbomify.com/GHSA-w5c7-9qqw-6645/index.md)","id":"GHSA-w5c7-9qqw-6645","markdown":"https://insights.sbomify.com/GHSA-w5c7-9qqw-6645/index.md","name":"GHSA-w5c7-9qqw-6645","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["privilege_escalation","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenClaw npm library","requires_auth":"low_privilege","summary":"Attackers can inject instructions into other sessions via inter-session messages, bypassing trust boundaries and triggering unintended privileged actions.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nInter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: \"user\"` without provenance metadata.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.12` (i.e. `\u003c 2026.2.13`)\n- Fixed in: `2026.2.13` (patched versions `\u003e= 2026.2.13`)\n\n## Impact\n\nA delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.\n\nThis is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust `role: \"user\"` as a sole authority signal.\n\n## Technical details\n\nBefore the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.\n\nAs a result, downstream workers and transcript readers could not distinguish:\n- External user input\n- Internal inter-session routed input\n\n## Fix\n\nOpenClaw now carries explicit input provenance end-to-end for routed prompts.\n\nKey changes:\n- Added structured provenance model (`inputProvenance`) with `kind` values including `inter_session`.\n- `sessions_send` and agent-to-agent steps now set inter-session provenance when invoking target runs.\n- Provenance is persisted on user messages as `message.provenance.kind = \"inter_session\"` (role remains `user` for provider compatibility).\n- Transcript readers and memory helpers were updated to respect provenance and avoid treating inter-session prompts as external user-originated input.\n- Runtime context rebuilding now annotates inter-session turns with an explicit in-memory marker (`[Inter-session message]`) for clearer model-side disambiguation.\n- Regression tests were added for transcript parsing, session tools flow, runner sanitization, and memory hook behavior.\n\n## Fix Commit(s)\n\n- `85409e401b6586f83954cb53552395d7aab04797`\n\n## Workarounds\n\nIf immediate upgrade is not possible:\n- Disable or restrict `sessions_send` in affected environments.\n- Do not use role alone as an authority boundary; require provenance-aware checks in orchestration logic.\n\n## Credit\n\nReported by @anbecker.\n\nThanks @anbecker for reporting.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"OpenClaw inter-session prompts could be treated as direct user instructions","id":"GHSA-w5c7-9qqw-6645","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"business_logic","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["2026.2.13"],"introduced":["0"],"last_affected":[],"package":"openclaw","purl":null,"source":"GHSA-w5c7-9qqw-6645"},{"ecosystem":"npm","fixed":["2026.2.13"],"introduced":["0"],"last_affected":[],"package":"openclaw","purl":"pkg:npm/openclaw","source":"GHSA-w5c7-9qqw-6645"}],"products":null,"published":"2026-02-18","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can inject instructions into other sessions via inter-session messages, bypassing trust boundaries and triggering unintended privileged actions.","url":"https://insights.sbomify.com/GHSA-w5c7-9qqw-6645/"}