GitHub Advisoryadvisory · npm

GHSA-27cr-4p5m-74rj OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

MEDIUM Published 2026-03-03 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-32033
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-180, CWE-22
Reviewed
2026-03-03

Affected packages

• npm openclaw: < 2026.2.24 → fixed in 2026.2.24

Description

A workspace-only file-system guard mismatch allowed `@`-prefixed absolute paths to bypass boundary validation in some tool path checks. Impact When `tools.fs.workspaceOnly=true`, certain `@`-prefixed absolute paths (for example `@/etc/passwd`) could be validated before canonicalization while runtime path handling normalized the prefix differently. In affected code paths this could permit reads outside the intended workspace boundary. Per `SECURITY.md`, OpenClaw is primarily a personal-assistant runtime with trusted-user assumptions, and this path is gated behind non-default sandbox/tooling configuration. That reduces practical exposure, but the bypass is still a security bug and is fixed. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published at triage time: `2026.2.23` • Affected versions: `= 2026.2.24` Fix Commit(s) • `9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260` OpenClaw thanks @tdjackey for reporting.

Related

Alias · CVE (1)

  • CVE-2026-32033 OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only… vulnerability

Weakness · CWE (2)

  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References