GHSA-659f-22xc-98f2 OpenClaw hook transform path containment missed symlink-resolved escapes

• npm openclaw: < 2026.2.22 → fixed in 2026.2.22

Vulnerability Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported. Affected Packages / Versions • Package: `openclaw` (npm) • Affected versions: `<= 2026.2.21-2` • Patched version (planned next release): `2026.2.22` Impact When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges. Attack Preconditions • Hook transforms are enabled and reachable. • Attacker can influence transform path resolution (for example via privileged config access and/or writable filesystem path in the transform tree). • A symlink escape exists to attacker-controlled code. Remediation • Enforce realpath-aware containment for existing path ancestors before dynamic import. • Keep lexical containment checks for traversal and absolute-path escapes. • Add regression coverage for: • transform module symlink escape rejection, • `hooks.transformsDir` symlink escape rejection, • in-root symlink allow-case. Fix Commit(s) • `f4dd0577b055f77af783105bd65eae32f3d5e6a1` OpenClaw thanks @aether-ai-agent for reporting.