What is the CVSS score of CVE-2026-35570?

CVE-2026-35570 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of OpenClaude are affected by CVE-2026-35570?

OpenClaude CLI versions 0.5.0 and earlier contain a path traversal vulnerability that allows authenticated local users with low privileges to read and modify arbitrary files on the system when…. A patch is available.

How to fix or mitigate CVE-2026-35570?

Within 24 hours: Inventory all systems running OpenClaude CLI 0.5.0 or earlier and disable auto-allow mode in all configurations. Within 7 days: Restrict OpenClaude CLI usage to single-user, isolated environments or air-gapped systems; implement file system access controls to limit CLI process permissions to only required directories. Within 30 days: Monitor the OpenClaude project repository for patch release (target version 0.5.1 or later); plan immediate upgrade once patch is available; consider evaluating alternative tools if no patch timeline is provided.

OpenClaude CVE-2026-35570

EUVD-2026-23988 HIGH

Path Traversal (CWE-22)

2026-04-21 security-advisories@github.com

GHSA-m6rx-7pvw-2f73

Path Traversal Openclaude

8.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 23, 2026 - 18:37 nvd

Patch available

Apr 21, 2026 - 16:31 EUVD

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 00:37 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 00:22 euvd

EUVD-2026-23988

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

HIGH 8.4

DescriptionGitHub Advisory

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in bashToolHasPermission() inside src/tools/BashTool/bashPermissions.ts. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an allow result immediately - before the path constraint filter (checkPathConstraints) is ever evaluated. This allows commands containing path traversal sequences (e.g., ../../../../../etc/passwd) to bypass directory restrictions entirely. Version 0.5.1 contains a patch for the issue.

AnalysisAI

Path traversal in OpenClaude CLI versions before 0.5.1 allows local authenticated users to bypass sandbox directory restrictions and access arbitrary filesystem paths. A logic flaw in the bash permission handler causes path constraint checks to be skipped when sandbox auto-allow is enabled without explicit deny rules, permitting traversal sequences like '../../../etc/passwd' to escape containment boundaries. EPSS score of 0.01% indicates low probability of widespread exploitation, and no active exploitation has been reported.

Technical ContextAI

OpenClaude is a command-line coding agent that integrates with cloud and local AI model providers. The vulnerability exists in the BashTool permission validation logic (bashToolHasPermission function in src/tools/BashTool/bashPermissions.ts). This is a classic CWE-22 path traversal flaw caused by improper control flow: when the sandbox auto-allow feature is active and no explicit deny rules are configured, the function short-circuits with an allow decision before invoking checkPathConstraints() - the filter responsible for validating path boundaries. This allows relative path sequences (../) to traverse outside intended directory constraints, potentially accessing sensitive system files or data that should be isolated from the AI agent's execution context. The local attack vector (AV:L) indicates exploitation requires existing access to the system running OpenClaude, while the changed scope (S:C) reflects that the vulnerability enables escaping the sandboxed execution environment.

RemediationAI

Upgrade to OpenClaude version 0.5.1 or later, which contains a fix for the permission validation logic flaw (commit 7002cb302b78ea2a19da3f26226de24e2903fa1d at https://github.com/Gitlawb/openclaude/commit/7002cb302b78ea2a19da3f26226de24e2903fa1d). If immediate upgrade is not feasible, implement compensating controls: (1) Disable the sandbox auto-allow feature and define explicit allow rules for required paths only - this forces path constraint validation on all operations but requires manual configuration overhead. (2) Configure explicit deny rules for sensitive filesystem locations (/etc, /root, credential stores) to trigger path checks even with auto-allow enabled - this adds defense-in-depth but does not address the root logic flaw. (3) Run OpenClaude processes under dedicated low-privilege service accounts with filesystem ACLs restricting access to only required directories - this limits blast radius but adds operational complexity. Note that workarounds do not eliminate the vulnerability and should be considered temporary until patching.