GitHub Advisoryadvisory · npm
GHSA-jf25-7968-h2h5 OpenClaw: screen_record outPath bypassed workspace-only filesystem guard
MEDIUM
Official page ↗
- Aliases
- CVE-2026-43567
- Ecosystem
- npm
- Packages
- openclaw
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-22, CWE-863
- Reviewed
- 2026-04-17
Affected packages
• npm openclaw: < 2026.4.10 → fixed in 2026.4.10
Description
Summary
screen_record outPath bypassed workspace-only filesystem guard.
Affected Packages / Versions
• Package: `openclaw`
• Ecosystem: npm
• Affected versions: `= 2026.4.10`
Impact
The node-host screen recording tool could honor an `outPath` outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.
Technical Details
The fix applies the workspace-root guard to node tool `outPath` handling, including screen recording paths.
Fix
The issue was fixed in #63551. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix.
Fix Commit(s)
• `635bb35b68d8faa5bfa2fda35feadd315122748a`
• PR: #63551
Release Process Note
Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.
Credits
Thanks to @anshumanbh for reporting this issue.
Related
Alias · CVE (1)
- CVE-2026-43567 OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses… vulnerability