GitHub Advisoryadvisory · npm

GHSA-42mx-vp8m-j7qh OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

MEDIUM Published 2026-04-07 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-41355
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-829
Reviewed
2026-04-07

Affected packages

• npm openclaw: < 2026.3.28 → fixed in 2026.3.28

Description

Summary OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup Current Maintainer Triage • Status: narrow • Normalized severity: medium • Assessment: Real on shipped = 2026.3.28` • First stable tag containing the fix: `v2026.3.28` Fix Commit(s) • `c02ee8a3a4cb390b23afdf21317aa8b2096854d1` — 2026-03-25T19:59:07Z Release Process Note • The fix is already present in released version `2026.3.28`. • This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @tdjackey for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41355 OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into… vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References