OpenClaw EUVD-2026-87508

Exploitation requires an operator to explicitly approve installation of a specially crafted or compromised .tar.bz2/.tbz2 skill archive in OpenClaw's tar.bz2 skill installer (versions >= 2026.5.28 and < 2026.8.1). The attacker must craft the archive so prohibited entries fall outside the bounded command-output suffixes that the installer mistakes for complete listings, making entry-count and size checks pass. Limiting factors: the mandatory human approval step (UI), the high complexity of shaping the archive listing (AC:H/AT:P), and the fact that impact is confined to disk/inode consumption in the skill tools directory - archive contents are not executed, so there is no confidentiality or integrity impact.

This is a low-priority issue where the low CVSS score and the real-world risk agree. The vendor CVSS 4.0 base score is 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L), reflecting availability-only impact (VA:L) with no confidentiality or integrity effect, high attack complexity (AC:H), an attack requirement (AT:P), and required user interaction (UI:P - an operator must approve the skill install). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided intelligence: no public exploit identified at time of analysis. The only signals of real exploitation friction are the crafted-archive requirement and, critically, the mandatory operator approval step - the description explicitly states the archive is only extracted 'if an operator approves installation.' The description also stresses the bug 'does not by itself execute archive contents,' so the worst outcome is disk-space or inode consumption in the skill tools directory, not code execution. Note: the vendor vector uses PR:N, but the operator-approval gate means this is not truly a zero-touch remote attack - the human-approval barrier (captured as UI:P/UI:R) is the dominant limiting factor and should weigh more than the network attack vector. Bottom line: genuine but minor resource-exhaustion DoS, not an urgent patch.

An attacker publishes or tampers with a .tar.bz2/.tbz2 OpenClaw skill archive so that prohibited over-limit entries are pushed out of both the retained command-output listing suffixes, causing entry-count and size budget checks to pass. When an operator is convinced to approve installation of this malicious skill, OpenClaw extracts the archive in full, persisting over-limit files or inodes and consuming disk space. No public exploit code is identified, and archive contents are not executed.