OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host
Summary
In openclaw@2026.2.24, approval-bound system.run on node hosts could be influenced by mutable symlink cwd targets between approval and execution.
Details
Approval matching on the gateway validated command/argv and binding fields, including cwd, as provided text. Node execution later used runtime cwd resolution. A symlinked cwd could therefore be retargeted after approval and before spawn.
OpenClaw's trust model does not treat one shared gateway as a multi-tenant adversarial boundary, but approval integrity is still a security boundary for operator-reviewed command execution.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.24 - Patched:
>= 2026.2.25
Fix Commit(s)
f789f880c934caa8be25b38832f27f90f37903db
Remediation
The fix adds defense-in-depth hardening for approval-bound node execution:
- reject symlink
cwdpaths for approval-boundsystem.run - canonicalize path-like executable argv before spawn
- bind CLI approval requests to exact
commandArgv
Release Process Note
Patched version is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.
OpenClaw thanks @tdjackey for reporting.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.2.25 | 2026.2.25 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-mwcg-wfq3-4gjc
- https://nvd.nist.gov/vuln/detail/CVE-2026-32043
- https://github.com/openclaw/openclaw/commit/f789f880c934caa8be25b38832f27f90f37903db
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-time-of-check-time-of-use-via-mutable-symlink-in-system-run-cwd-parameter
- CVSS vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-367, CWE-59- Platform
- npm
- Package
openclaw- Disclosed
- 03.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mwcg-wfq3-4gjc - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.