Mf Yang
Monthly
Symlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traverse outside the intended sandbox boundary by exploiting a failure in the assertNoSymlinkEscape validation function in src/agents/sandbox-paths.ts. Attackers with low-level access can craft symbolic links within the sandbox that resolve to paths outside it, yielding limited unauthorized read and write access to the underlying filesystem. A public proof-of-concept exploit is documented in GitHub issue #566, and no vendor patch has been released as the project has not responded to disclosure.
Privilege escalation in openclaw-cn (all versions up to 0.2.1) allows a remote attacker with low-level authentication to bypass the `isApprovedElevatedSender` privilege check in the auto-reply module and assume elevated sender permissions. A publicly disclosed proof-of-concept exploit exists on GitHub issue #564, and the project maintainer has not responded to the responsible disclosure report. No CISA KEV listing exists, but the low attack complexity combined with POC availability makes this a credible risk for any active deployment of the affected application.
Incorrect authorization in openclaw-cn 2026.2.5 allows authenticated remote attackers to bypass the Gateway Exec Approval Flow, circumventing the intended control that governs bash command execution through the agent gateway. The flaw resides in src/agents/bash-tools.exec.ts and is classified as CWE-863 (Incorrect Authorization). No public exploit identified at time of analysis is incorrect here - a proof-of-concept is publicly available via GitHub issue #563, though CISA KEV listing is absent, indicating no confirmed mass exploitation at time of analysis.
Server-side request forgery in openclaw-cn up to version 0.2.1 via the Browser Control HTTP API enables authenticated remote attackers to manipulate server-side requests, potentially accessing internal resources. Public exploit code is available in the project's GitHub issue tracker, but no active exploitation has been confirmed through CISA KEV. The vulnerability affects deployments where the browser control API is exposed, requiring low-privilege access to exploit.
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privileges to leak sensitive data by supplying a crafted URL to the scheme handler. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV.
Symlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traverse outside the intended sandbox boundary by exploiting a failure in the assertNoSymlinkEscape validation function in src/agents/sandbox-paths.ts. Attackers with low-level access can craft symbolic links within the sandbox that resolve to paths outside it, yielding limited unauthorized read and write access to the underlying filesystem. A public proof-of-concept exploit is documented in GitHub issue #566, and no vendor patch has been released as the project has not responded to disclosure.
Privilege escalation in openclaw-cn (all versions up to 0.2.1) allows a remote attacker with low-level authentication to bypass the `isApprovedElevatedSender` privilege check in the auto-reply module and assume elevated sender permissions. A publicly disclosed proof-of-concept exploit exists on GitHub issue #564, and the project maintainer has not responded to the responsible disclosure report. No CISA KEV listing exists, but the low attack complexity combined with POC availability makes this a credible risk for any active deployment of the affected application.
Incorrect authorization in openclaw-cn 2026.2.5 allows authenticated remote attackers to bypass the Gateway Exec Approval Flow, circumventing the intended control that governs bash command execution through the agent gateway. The flaw resides in src/agents/bash-tools.exec.ts and is classified as CWE-863 (Incorrect Authorization). No public exploit identified at time of analysis is incorrect here - a proof-of-concept is publicly available via GitHub issue #563, though CISA KEV listing is absent, indicating no confirmed mass exploitation at time of analysis.
Server-side request forgery in openclaw-cn up to version 0.2.1 via the Browser Control HTTP API enables authenticated remote attackers to manipulate server-side requests, potentially accessing internal resources. Public exploit code is available in the project's GitHub issue tracker, but no active exploitation has been confirmed through CISA KEV. The vulnerability affects deployments where the browser control API is exposed, requiring low-privilege access to exploit.
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privileges to leak sensitive data by supplying a crafted URL to the scheme handler. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV.