8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35570

CVE-2026-35570: OpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in bashToolHasPermission() inside src/tools/BashTool/bashPermissions.ts. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an allow result immediately — before the path constraint filter (checkPathConstraints) is ever evaluated. This allows commands containing path traversal sequences (e.g., ../../../../../etc/passwd) to bypass directory restrictions entirely. Version 0.5.1 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35570

CVE-2026-35570:

8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@gitlawb/openclaude	npm	< 0.5.1	0.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a logic flaw in the bashToolHasPermission function located in src/tools/BashTool/bashPermissions.ts. The provided patch 7002cb302b78ea2a19da3f26226de24e2903fa1d clearly shows the fix. The original code had a condition that would cause an early exit from the function if the sandbox auto-allow mechanism returned a behavior other than 'passthrough'. When auto-allow is enabled, this would result in an 'allow' behavior, causing the function to return before the critical path traversal checks in checkPathConstraints could be performed. This allowed an attacker to bypass sandbox restrictions. The patch corrects this by only allowing an early exit for 'deny' or 'ask' behaviors, forcing 'allow' results to proceed through the rest of the security checks, including the path constraint validation. Therefore, bashToolHasPermission is the vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

bashToolHasPermission

src/tools/BashTool/bashPermissions.ts

The vulnerability lies in the `bashToolHasPermission` function. The original code would check the result of `checkSandboxAutoAllow` and if the behavior was not 'passthrough', it would immediately return. In the case of an auto-allow in a sandbox environment, this result would be 'allow', causing the function to return before executing the `checkPathConstraints` function, which is responsible for preventing path traversal attacks. The patch changes this logic to only return early for 'deny' or 'ask' behaviors, ensuring that an 'allow' result proceeds to the path constraint checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.