Sign in
Deutsch English Español Polski
Medium

OpenClaw contains a symlink traversal vulnerability

  • Disclosed: 05.05.2026
  • Updated: 11.10.2026 10:22

OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package openclaw >= 2026.3.22, < 2026.4.5 2026.4.5

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-61
Platform
npm
Package
openclaw
Disclosed
05.05.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-35mw-5vvr-vrxc - CC BY 4.0

Vulnerability history: openclaw

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (588) in the archive
Total entries
588
First → latest
02.2026 07.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 20
  • High 215
  • Medium 299
  • Low 54

Disclosures per year

Severity:
  1. OpenClaw contains a symlink traversal vulnerability this entry
    Medium · 6.5 CVE-2026-43570 >= 2026.3.22, < 2026.4.5 2026.4.5
  2. OpenClaw: Native command authorization could skip owner-command enforcement
    High CVE-2026-53828 < 2026.5.6 2026.5.6
  3. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    High · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  4. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    High CVE-2026-53839 < 2026.5.7 2026.5.7
  5. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    High CVE-2026-53807 < 2026.5.6 2026.5.6
  6. OpenClaw: Matrix allowFrom could bind to mutable display names
    High · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  7. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    High · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  8. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    High · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  9. OpenClaw: Fake package roots could influence memory-core artifact loading
    High · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  10. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    High · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  11. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    High · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  12. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    High · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  13. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Critical CVE-2026-34507 < 2026.4.29 2026.4.29
  14. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    High · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  15. OpenClaw: Slack allowFrom could bind to mutable display names
    High CVE-2026-53823 < 2026.5.3 2026.5.3
  16. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    High · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  17. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    High · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  18. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    High · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  19. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    High · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  20. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    High · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  21. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    High · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
Show more (20) Showing 21 of 236

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.