GitHub Advisoryadvisory · npm
GHSA-35mw-5vvr-vrxc OpenClaw contains a symlink traversal vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2026-43570
- Ecosystem
- npm
- Packages
- openclaw
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-61
- Reviewed
- 2026-05-08
Affected packages
• npm openclaw: >= 2026.3.22, < 2026.4.5 → fixed in 2026.4.5
Description
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.
Related
Alias · CVE (1)
- CVE-2026-43570 OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that… vulnerability
Weakness · CWE (1)
- CWE-61 UNIX Symbolic Link (Symlink) Following weakness
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-43570 advisory
- https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c537f3a web
- https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538edaeae web
- https://github.com/openclaw/openclaw package
- https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marketplace-repository-path-handling web