GitHub Advisoryadvisory · npm

GHSA-xw4p-pw82-hqr7 OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace

MEDIUM Published 2026-03-02 Modified 2026-03-06 Official page ↗
Aliases
CVE-2026-28457
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
Weaknesses
CWE-22
Reviewed
2026-03-02

Affected packages

• npm openclaw: < 2026.2.14 → fixed in 2026.2.14

Description

Overview In affected versions, OpenClaw’s sandbox skill mirroring used the skill’s frontmatter `name` as part of the destination path when copying skills into the sandbox workspace. A crafted skill name containing traversal segments (for example `../`) or an absolute path could cause the copy to write outside `/skills/`. Impact • Files may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw). Attack Requirements • Attacker can provide a skill package (controls `SKILL.md` frontmatter). • Victim runs with sandbox enabled and skill mirroring into the sandbox workspace. Affected Packages / Versions • `openclaw` (npm): `= 2026.2.14` Fix Commit(s) • 3eb6a31b6fcf8268456988bfa8e3637d373438c2 OpenClaw thanks @1seal for reporting.

Related

Alias · CVE (1)

  • CVE-2026-28457 OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References