Is there a public PoC exploit available for CVE-2026-19008?

Yes, a public proof-of-concept exploit is available for CVE-2026-19008. Prioritise patching immediately. EPSS: 0.3%.

openclaw-cn CVE-2026-19008

Q: What is the CVSS score of CVE-2026-19008?

CVE-2026-19008 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-53766 LOW

Improper Link Resolution Before File Access (CWE-59)

2026-08-06 VulDB

GHSA-2mj8-f2gc-5q5j

Information Disclosure Openclaw Cn Mf Yang

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable by low-privilege authenticated users; symlink traversal yields limited read/write outside sandbox but no availability impact or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 08:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 08:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 06, 2026 - 07:46 vuln.today

CVE Published

Aug 06, 2026 - 06:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Symlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traverse outside the intended sandbox boundary by exploiting a failure in the assertNoSymlinkEscape validation function in src/agents/sandbox-paths.ts. Attackers with low-level access can craft symbolic links within the sandbox that resolve to paths outside it, yielding limited unauthorized read and write access to the underlying filesystem. A public proof-of-concept exploit is documented in GitHub issue #566, and no vendor patch has been released as the project has not responded to disclosure.

Technical ContextAI

openclaw-cn (CPE: cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*) is a TypeScript-based AI agent framework whose apply_patch Tool component performs file modification operations within a defined sandbox. The function assertNoSymlinkEscape in src/agents/sandbox-paths.ts is responsible for preventing sandbox escapes by checking that resolved paths remain within the permitted working area. CWE-59 (Improper Link Resolution Before File Access - Link Following) describes the root cause: the function evaluates the symbolic link path before fully resolving it, meaning a symlink created inside the sandbox directory that points to an external path can bypass the containment check. This is a well-documented class of sandbox bypass vulnerability in file-manipulation tools and coding agents that permit patch application to filesystem paths.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the coordinated disclosure via GitHub issue #565. Users should monitor the repository at https://github.com/mf-yang/openclaw-cn for a fix release. As an immediate compensating control, disable or restrict access to the apply_patch Tool component if patch application is not a required workflow, which entirely eliminates the attack surface at the cost of losing that functionality. Where apply_patch must remain enabled, run openclaw-cn as a low-privileged OS user and enforce OS-level filesystem isolation - for example, deploying within a container with read-only bind mounts for all directories outside the intended working area, so symlink resolution to external paths yields permission denied rather than access. Restricting which users or roles can invoke the apply_patch Tool to only fully trusted accounts limits the authenticated exploitation surface without impacting legitimate use.