### Summary
In sandboxed runs, native prompt image auto-load did not honor `tools.fs.workspaceOnly=true`.

This optional hardening setting is **not enabled by default**. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example `/agent/secret.png`) and load those image bytes for vision-capable model input.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.2.23`
- Vulnerable version range: `<= 2026.2.23`
- Patched version (planned next release): `2026.2.24`

### Conditions Required
This issue required all of the following:
- sandbox mode enabled,
- `tools.fs.workspaceOnly=true` configured,
- an out-of-workspace mount path reachable from the sandbox (for example `/agent`),
- vision-capable model path active for native prompt image loading.

### Technical Details
Native prompt image ingestion (`detectAndLoadPromptImages` / `loadImageFromRef`) resolved and read sandbox paths but did not apply the same workspace-root assertion used by file tools when `tools.fs.workspaceOnly` was set.

### Fix Commit(s)
- `370d115549c0dadace0902775eea0d5094aedfdc`

### Verification
- `pnpm check`
- `pnpm exec vitest run --config vitest.gateway.config.ts`
- `pnpm test:fast`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.24`) so once npm release is available, this advisory only needs publish action.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`[email protected]` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.

CWE-200 Information Exposure

CWE-284 Improper Access Control