GHSA-5h3g-6xhh-rg6p OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

• npm openclaw: < 2026.4.22 → fixed in 2026.4.22

Summary OpenShell FS bridge reads pin and verify the opened file before returning bytes Affected Packages / Versions • Package: openclaw (npm) • Affected versions: <= 2026.4.21 • Fixed version: 2026.4.22 Impact A time-of-check/time-of-use race around OpenShell sandbox filesystem reads could let a symlink swap cause bytes outside the intended mount root to be read. Fix OpenShell reads now open the file with no-follow semantics where available, validate the pinned file descriptor against the canonical mount root, reject unsafe hardlink/symlink cases, and use a strict fallback ancestor walk on platforms without fd-path readback. Fix Commit(s) • 95119017c847c737bd113f0bff728c4666d79c45 Verification • The fix commit is contained in the public v2026.4.22 tag. • [email protected] is published on npm and the compiled package contains the fix. • Focused regression coverage for this path passed before publication. Thanks @VladimirEliTokarev for reporting.