EUVD-2026-25322
GHSA-9hhx-mwf2-vr7v
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local race-condition exploitation via symlink rebind, low-privilege account and user interaction required; S:C captures sandbox escape to out-of-root filesystem paths.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Attackers can exploit check-then-act patterns in apply_patch, remove, and mkdir operations to manipulate files between validation and execution.
AnalysisAI
Sandbox file-operation escape in OpenClaw npm versions <= 2026.3.28 allows a local low-privileged attacker to delete or create files outside the designated workspace root by winning a symlink-rebind race between path validation and filesystem execution in apply_patch, remove, and mkdir operations. The GHSA maintainer triage confirms the scope is narrow - limited to workspace-only mutation operations - and the fix in 2026.3.31 replaces check-then-act enforcement with atomic fd-safe path-within-root helpers. No public exploit exists and SSVC confirms exploitation status as none, placing real-world priority low despite the high integrity impact rating.
Technical ContextAI
OpenClaw is a Node.js/npm-based AI coding agent whose sandbox enforces a workspace root boundary to prevent file operations from escaping the designated directory. The vulnerable code path in apply-patch.ts called assertSandboxPath to resolve and validate a file path via realpath, then separately invoked fs.rm or fs.mkdir. This non-atomic check-then-act pattern is precisely described by CWE-367 (Time-of-check Time-of-use Race Condition): an attacker who can rebind a symlink between the realpath call and the filesystem operation causes the operation to execute against the post-rebind, out-of-sandbox target. The fix introduces removePathWithinRoot and mkdirPathWithinRoot (from infra/fs-safe.js) which resolve and operate on the path atomically within the root, eliminating the exploitable window. CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all versions prior to 2026.3.31. The vulnerability only manifests on POSIX systems - the test harness explicitly skips Windows (process.platform !== 'win32').
RemediationAI
Upgrade the OpenClaw npm package to version 2026.3.31 or later, which is the vendor-released patch containing fix commit 32a4a47d602e0618f87b3e59f94d8c142767f860. The full advisory is at https://github.com/openclaw/openclaw/security/advisories/GHSA-rm5c-4rmf-vvhw. If immediate upgrade is not feasible, restrict local user accounts on the host to trusted principals only, eliminating the attacker's ability to rebind symlinks concurrently with OpenClaw workspace operations; this reduces attack surface but does not eliminate the vulnerability. An additional compensating control is to avoid running OpenClaw in environments where untrusted local users share the same filesystem namespace. Windows deployments require no action as symlink rebinding of this type is not applicable on that platform.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today