openclaw-cn CVE-2026-19008

Exploitation requires the attacker to hold low-privilege authenticated access to an openclaw-cn instance running version 0.2.1 or earlier, and the ability to cause the apply_patch tool to process a crafted path that includes an attacker-controlled symbolic link within the sandbox directory. The attacker must have OS-level permission to create symlinks in the sandbox working directory, which is the standard permission for any authenticated user of the tool. No special non-default configuration is required - the apply_patch Tool component is part of the default agent capabilities. Exploitation is bounded by the OS-level privileges of the process running openclaw-cn: only files readable or writable by that process account are reachable, limiting full system compromise. Remote network access alone is insufficient - low-privilege authentication is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with E:P indicates a network-reachable, low-complexity attack requiring only low-privilege authentication and a publicly available proof-of-concept. The impact triad is uniformly low (VC:L/VI:L/VA:L) with no scope change to subsequent systems (SC:N/SI:N/SA:N), yielding a moderate 5.3 score. There is no CISA KEV listing, confirming no evidence of active widespread exploitation - the public POC elevates urgency relative to a zero-POC finding but does not confirm mass exploitation. The product's deployment footprint is assessed as rare (an obscure, niche AI coding agent with a small community), which substantially limits real-world blast radius despite the accessible attack vector. The combination of low impact, limited prevalence, and no KEV listing places this as a low-to-medium operational priority. The absence of any vendor response to disclosure is a notable risk governance gap for anyone actively using this tool.

An authenticated user with low-level access to an openclaw-cn instance creates a symbolic link inside the sandbox working directory - for example, linking a file named patch-target.txt to /etc/passwd or ~/.ssh/authorized_keys. The attacker then submits a patch operation referencing that symlink path; the assertNoSymlinkEscape function evaluates the path before full resolution and incorrectly concludes it is within bounds, causing the apply_patch tool to read or modify the external file. A public proof-of-concept demonstrating this technique is available in GitHub issue #566.