OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path
OpenClaw's skills download installer validated the intended per-skill tools root lexically, but later reused that mutable path while downloading and copying the archive into place. If a local attacker could rebind that tools-root path between validation and the final write, the installer could be redirected to write outside the intended tools directory.
The fix pins the canonical per-skill tools root immediately after validation and derives later download/copy paths from that canonical root, so rebinding the lexical path fails closed instead of redirecting the write.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published vulnerable version:
2026.3.7 - Affected range:
<= 2026.3.7 - Fixed in released version:
2026.3.8
Fix Commit(s)
9abf014f3502009faf9c73df5ca2cff719e54639
Release Verification
- Verified fixed in GitHub release
v2026.3.8published on March 9, 2026. - Verified
npm view openclaw versionresolves to2026.3.8. - Verified the release contains the regression test covering tools-root rebinding and that the test passes against the
v2026.3.8tree.
Thanks @tdjackey for reporting.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.3.8 | 2026.3.8 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-vhwf-4x96-vqx2
- https://nvd.nist.gov/vuln/detail/CVE-2026-33574
- https://github.com/openclaw/openclaw/commit/9abf014f3502009faf9c73df5ca2cff719e54639
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-path-traversal-via-tools-root-rebinding-in-skills-download
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-367- Platform
- npm
- Package
openclaw- Disclosed
- 12.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vhwf-4x96-vqx2 - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.