GitStock

openclaw/openclaw · Security

OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace

Open GitHub
GHSA ID
GHSA-xw4p-pw82-hqr7
CVE ID
CVE-2026-28457
Severity
medium
Published
Updated
CVSS
7.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
CVSS v3
7.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
CVSS v4
5.7 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Description

Overview

In affected versions, OpenClaw’s sandbox skill mirroring used the skill’s frontmatter name as part of the destination path when copying skills into the sandbox workspace. A crafted skill name containing traversal segments (for example ../) or an absolute path could cause the copy to write outside <sandbox_workspace>/skills/.

Impact

  • Files may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw).

Attack Requirements

  • Attacker can provide a skill package (controls SKILL.md frontmatter).
  • Victim runs with sandbox enabled and skill mirroring into the sandbox workspace.

Affected Packages / Versions

  • openclaw (npm): < 2026.2.14

Fixed In

  • openclaw (npm): >= 2026.2.14

Fix Commit(s)

  • 3eb6a31b6fcf8268456988bfa8e3637d373438c2

OpenClaw thanks @1seal for reporting.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References