Iniciar sesión
Deutsch English Español Polski
Crítica

OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

  • Publicada: 02.03.2026
  • Actualizado: 11.10.2026 10:22

Impact

The gateway agents.files.get and agents.files.set methods allowed symlink traversal for allowlisted workspace files. A symlinked allowlisted file (for example AGENTS.md) could resolve outside the agent workspace and be read/written by the gateway process.

This could enable arbitrary host file read/write within the gateway process permissions, and chained impact up to code execution depending on which files are overwritten.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.24
  • Latest published vulnerable version at patch time: 2026.2.24
  • Patched versions: >= 2026.2.25

Remediation

agents.files now resolves real workspace paths, enforces containment for resolved targets, rejects out-of-workspace symlink targets, and keeps in-workspace symlink targets supported. The patch also adds gateway regression tests for blocked escapes and valid in-workspace symlink behavior.

Fix Commit(s)

  • 125f4071bcbc0de32e769940d07967db47f09d3d

Release Process Note

patched_versions is intentionally pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm openclaw < 2026.2.25 2026.2.25

Referencias

Puntuación CVSS 8.8/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Debilidad (CWE)
CWE-22, CWE-59
Plataforma
npm
Paquete
openclaw
Publicada
02.03.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-fgvx-58p6-gjwc - CC BY 4.0

Historial de vulnerabilidades: openclaw

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (588) en el archivo
Entradas en total
588
Primera → última
02.2026 07.2026
Sin corrección
9
Explotada en ataques
0

Distribución por gravedad

  • Crítica 20
  • Alta 215
  • Media 299
  • Baja 54

Divulgaciones por año

Gravedad:
  1. OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write esta entrada
    Crítica · 8.8 CVE-2026-32013 < 2026.2.25 2026.2.25
  2. OpenClaw: Native command authorization could skip owner-command enforcement
    Alta CVE-2026-53828 < 2026.5.6 2026.5.6
  3. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Alta · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  4. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Alta CVE-2026-53839 < 2026.5.7 2026.5.7
  5. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Alta CVE-2026-53807 < 2026.5.6 2026.5.6
  6. OpenClaw: Matrix allowFrom could bind to mutable display names
    Alta · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  7. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Alta · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  8. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Alta · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  9. OpenClaw: Fake package roots could influence memory-core artifact loading
    Alta · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  10. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Alta · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  11. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Alta · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  12. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Alta · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  13. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Crítica CVE-2026-34507 < 2026.4.29 2026.4.29
  14. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Alta · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  15. OpenClaw: Slack allowFrom could bind to mutable display names
    Alta CVE-2026-53823 < 2026.5.3 2026.5.3
  16. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Alta · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  17. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Alta · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  18. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Alta · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  19. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Alta · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  20. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Alta · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  21. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Alta · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  22. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Alta · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  23. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Alta · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  24. OpenClaw: Shell wrapper argv could change between approval and execution
    Alta CVE-2026-53822 < 2026.5.18 2026.5.18
  25. OpenClaw: Exec approval display truncation could hide the command being approved
    Alta · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  26. OpenClaw: Message read actions could skip channel allowlist checks
    Alta · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  27. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Alta · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  28. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Alta · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  29. OpenClaw: Discord allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  30. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Alta · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  31. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Alta · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  32. OpenClaw: Zalo allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  33. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Alta · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  34. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Alta · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  35. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Alta · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  36. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Alta · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  37. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Alta · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  38. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Alta · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  39. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Alta · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  40. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Alta · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  41. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Alta · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  42. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Alta · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  43. OpenClaw: Feishu webhook and card-action validation now fail closed
    Crítica · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  44. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Crítica · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  45. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Alta CVE-2026-43533 < 2026.4.10 2026.4.10
  46. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Alta · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  47. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Alta · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  48. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Alta · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  49. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Alta · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  50. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Alta CVE-2026-43581 < 2026.4.10 2026.4.10
  51. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Alta · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  52. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Alta · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  53. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Alta · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  54. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Alta CVE-2026-43528 < 2026.4.14 2026.4.14
  55. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Alta CVE-2026-40037 < 2026.4.8 2026.4.8
  56. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Alta · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  57. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Alta CVE-2026-42427 < 2026.4.8 2026.4.8
  58. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Alta ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  59. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Alta ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  60. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Alta · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  61. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Alta · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  62. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    Alta CVE-2026-34511 < 2026.4.2 2026.4.2
  63. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    Alta CVE-2026-41393 < 2026.3.31 2026.3.31
  64. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    Alta · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  65. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    Alta CVE-2026-41353 < 2026.3.22 2026.3.22
  66. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    Alta · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  67. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Crítica · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  68. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    Alta · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  69. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    Alta CVE-2026-41404 < 2026.3.31 2026.3.31
  70. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    Alta CVE-2026-41349 < 2026.3.28 2026.3.28
  71. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    Alta · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  72. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    Alta · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  73. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    Alta · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  74. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    Alta CVE-2026-41366 < 2026.3.31 2026.3.31
  75. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    Alta · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  76. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    Alta · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  77. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    Alta · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  78. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    Alta · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  79. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Crítica CVE-2026-41329 < 2026.3.31 2026.3.31
  80. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    Alta · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  81. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Crítica · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
  82. OpenClaw gateway exec allow-always over-trusts positional carrier executables
    Alta · 7.3 CVE-2026-41380 < 2026.3.28 2026.3.28
  83. OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`
    Alta CVE-2026-41371 < 2026.3.28 2026.3.28
  84. OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper
    Alta · 7.3 CVE-2026-41390 < 2026.3.28 2026.3.28
  85. OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
    Alta · 9.6 CVE-2026-41387 < 2026.3.22 2026.3.22
  86. OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing
    Alta CVE-2026-41299 < 2026.3.28 2026.3.28
  87. OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
    Alta · 7.7 CVE-2026-41368 < 2026.3.28 2026.3.28
  88. OpenClaw's message tool media parameter bypasses tool policy filesystem isolation
    Alta · 6.2 CVE-2026-33581 < 2026.3.24 2026.3.24
  89. OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals
    Alta · 8.8 CVE-2026-41303 < 2026.3.28 2026.3.28
  90. OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
    Alta · 7.5 CVE-2026-34503 < 2026.3.28 2026.3.28
  91. OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
    Alta · 7.3 CVE-2026-41342 < 2026.3.28 2026.3.28
  92. OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation
    Crítica CVE-2026-33579 < 2026.3.28 2026.3.28
  93. OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
    Alta CVE-2026-41395 < 2026.3.28 2026.3.28
  94. OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
    Alta · 8.1 CVE-2026-35653 < 2026.3.24 2026.3.24
  95. OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
    Alta CVE-2026-35621 < 2026.3.24 2026.3.24
  96. OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
    Alta · 8.6 CVE-2026-35641 < 2026.3.24 2026.3.24
  97. OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
    Alta · 7.7 CVE-2026-35668 < 2026.3.24 2026.3.24
  98. OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
    Alta CVE-2026-35629 < 2026.3.28 2026.3.28
  99. OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
    Alta CVE-2026-35636 >= 2026.3.11, < 2026.3.28 2026.3.28
  100. OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
    Alta CVE-2026-35669 <= 2026.3.24 sin corrección
  101. OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
    Crítica CVE-2026-35625 <= 2026.3.24 sin corrección
Mostrar más (20) Mostrando 101 de 235

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.