EUVD-2026-25339
GHSA-m563-373q-885c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector for sandbox file access; AC:H for four mandatory preconditions; PR:L for required mirror mode access; UI:R for gateway restart dependency; S:C for sandbox-to-host scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.28.
DescriptionCVE.org
OpenShell before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host during gateway startup by exploiting enabled workspace hooks.
AnalysisAI
Arbitrary code execution in OpenClaw's OpenShell mirror mode (npm package versions <= 2026.3.24) allows attackers with mirror mode access to plant malicious JavaScript in the sandbox hooks/ directory, which is synced to the host workspace and executed during gateway startup. The GHSA advisory confirms this flaw shipped in production releases and rates it medium severity due to a narrow exploitation chain requiring four concurrent conditions. EPSS is 0.01% (2nd percentile) and SSVC indicates no active exploitation; no CISA KEV listing exists at time of analysis, though technical impact is rated total if successfully exploited. Vendor-released patch is available in v2026.3.28.
Technical ContextAI
CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) describes the root cause: the replaceDirectoryContents() function in mirror.ts synchronized all files from a remote sandbox to the local workspace without excluding the trusted hooks/ directory. OpenClaw's workspace hooks are explicitly-enabled JavaScript modules executed on the host with gateway-process privileges during startup - a privileged execution context entirely separate from the sandboxed environment. The mirror mode feature is designed to sync sandbox content to the host, but the absence of an exclusion for hooks/ meant attacker-controlled sandbox files could silently overwrite or populate the trusted hook directory. The fix (commit c02ee8a3a4cb390b23afdf21317aa8b2096854d1) adds an excludeDirs parameter with case-insensitive matching to block any sandbox content from being written into hooks/ on the host, preventing the trust boundary violation. CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* identifies this as the openclaw npm package.
RemediationAI
Upgrade the openclaw npm package to version 2026.3.28 or later (2026.3.31 confirmed as the latest stable version at time of GHSA publication). The fix is documented in the GHSA advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-42mx-vp8m-j7qh and implemented via commit c02ee8a3a4cb390b23afdf21317aa8b2096854d1. For environments unable to upgrade immediately, either of two targeted workarounds breaks the required attack chain: disabling mirror mode entirely prevents the sync vector but removes the mirror functionality for all users; alternatively, disabling workspace hooks prevents execution of any synced malicious content but may break legitimate hook-based workspace automation. Disabling hooks is the lower-impact workaround if mirror mode is operationally required. Both workarounds should be treated as temporary - upgrade to 2026.3.28+ is the definitive fix.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Share
External POC / Exploit Code
Leaving vuln.today