N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-27cr-4p5m-74rj

GHSA-27cr-4p5m-74rj: OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

A workspace-only file-system guard mismatch allowed @-prefixed absolute paths to bypass boundary validation in some tool path checks.

Impact

When tools.fs.workspaceOnly=true, certain @-prefixed absolute paths (for example @/etc/passwd) could be validated before canonicalization while runtime path handling normalized the prefix differently. In affected code paths this could permit reads outside the intended workspace boundary.

Per SECURITY.md, OpenClaw is primarily a personal-assistant runtime with trusted-user assumptions, and this path is gated behind non-default sandbox/tooling configuration. That reduces practical exposure, but the bypass is still a security bug and is fixed.

Affected Packages / Versions

Package: openclaw (npm)
Latest published at triage time: 2026.2.23
Affected versions: <= 2026.2.23
Patched versions: >= 2026.2.24

Fix Commit(s)

9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-27cr-4p5m-74rj

GHSA-27cr-4p5m-74rj:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.23	2026.2.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in OpenClaw, where the application mishandles '@-prefixed' absolute paths. The security advisory GHSA-27cr-4p5m-74rj states that this allowed bypassing workspace boundary checks. The core of the issue is that path validation was performed before path canonicalization, meaning the path was checked for safety and then later modified by the runtime in a way that changed its meaning from a relative path to an absolute one.

The analysis of the patch commit 9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260 confirms this. The changes are centered around normalizing paths by stripping the '@' prefix before they are used or validated. Two functions were identified as being vulnerable:

mapContainerPathToWorkspaceRoot in src/agents/pi-tools.read.ts: This function is used by tools to map paths. The patch explicitly adds logic to remove the '@' prefix. Before the fix, it would pass the raw path to the validation logic, leading to the bypass.
expandPath in src/agents/sandbox-paths.ts: This is a more generic path utility function. It was also patched to handle the '@' prefix, indicating that this vulnerability could be triggered through multiple code paths that rely on this function for path resolution.

During an exploit, an attacker would supply a path like '@/etc/passwd' to a tool, for instance, a file reading tool. This would cause mapContainerPathToWorkspaceRoot or expandPath to be called. These functions would, before the patch, fail to normalize the path, leading to the security check being performed on the wrong path representation. Therefore, these two functions are the key indicators of this vulnerability being triggered and would appear in a runtime profile of an exploit.

Vulnerable functions

mapContainerPathToWorkspaceRoot

src/agents/pi-tools.read.ts

This function was vulnerable because it did not handle file paths prefixed with '@'. A malicious actor could provide a path like '@/etc/passwd'. The function would pass this path to the validation logic without modification. The validation logic would incorrectly treat it as a safe, relative path within the workspace. However, the runtime would later strip the '@' prefix and interpret '/etc/passwd' as an absolute path, thus allowing an attacker to read arbitrary files on the system, bypassing the workspace sandbox.

expandPath

src/agents/sandbox-paths.ts

This function is responsible for expanding and normalizing file paths. Prior to the patch, it did not handle the '@' prefix. This meant that a path like '@/etc/passwd' would be passed through the function unmodified. Subsequent code could then interpret this path in an unsafe way, leading to a path traversal vulnerability. The patch fixes this by introducing `normalizeAtPrefix` to strip the '@' before any other processing, ensuring that the path is correctly validated against the sandbox.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.