N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-42mx-vp8m-j7qh

GHSA-42mx-vp8m-j7qh: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

Summary

OpenShell mirror mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

Current Maintainer Triage

Status: narrow
Normalized severity: medium
Assessment: Real on shipped <=2026.3.22 OpenShell mirror sync, but exploit needs mirror mode plus hooks enabled plus explicit hook opt-in plus restart, so high is overstated even though the direct fix shipped in v2026.3.28.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.24
Patched versions: >= 2026.3.28
First stable tag containing the fix: v2026.3.28

Fix Commit(s)

c02ee8a3a4cb390b23afdf21317aa8b2096854d1 — 2026-03-25T19:59:07Z

Release Process Note

The fix is already present in released version 2026.3.28.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-42mx-vp8m-j7qh

GHSA-42mx-vp8m-j7qh:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.24	2026.3.28

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for remote code execution by exploiting the 'mirror' mode in OpenShell. An attacker could place malicious files in a sandbox's hooks directory. During the mirroring process, these malicious hooks were being copied to the host's workspace because the synchronization function did not exclude any directories.

The root cause of the vulnerability is the replaceDirectoryContents function located in extensions/openshell/src/mirror.ts. The original implementation of this function would clear the target directory and then copy all files and directories from the source. It lacked any filtering or exclusion capabilities.

The patch in commit c02ee8a3a4cb390b23afdf21317aa8b2096854d1 rectifies this flaw. It modifies replaceDirectoryContents to accept an excludeDirs option and then filters which directories are deleted from the target and copied from the source. The call site in extensions/openshell/src/backend.ts within the OpenShellSandboxBackendImpl class was also updated to pass excludeDirs: ["hooks"] to replaceDirectoryContents, preventing the hooks directory from being synchronized.

Therefore, the replaceDirectoryContents function is the central point of the vulnerability. Any runtime profile captured during exploitation would show this function being executed as it performs the unsafe directory mirroring.

Vulnerable functions

replaceDirectoryContents

extensions/openshell/src/mirror.ts

This function was vulnerable because it did not provide a mechanism to exclude directories when mirroring content. It would delete the contents of the target directory and copy everything from the source directory, allowing an attacker-controlled 'hooks' directory from a sandbox to be copied into the trusted workspace, leading to code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.