5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-77hf-7fqf-f227

GHSA-77hf-7fqf-f227: OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)

Summary

The tar.bz2 installer path in src/agents/skills-install-download.ts used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor.

This allowed crafted .tar.bz2 archives to bypass special-entry blocking and extracted-size guardrails enforced on other archive paths, causing local availability impact during skill install.

Affected Packages / Versions

Package: openclaw (npm)
Latest published at triage time: 2026.3.1
Affected range: <= 2026.3.1
Patched in: 2026.3.2 (released)

Impact

Local DoS / availability impact when processing untrusted .tar.bz2 skill archives.

Fix Commit(s)

0dbb92dd2bcf9a32379d11c0f11ed016669dae3e

Related advisories

Canonical overlap (closed): GHSA-3pj7-x8jr-jvj8
Duplicate variant (closed): GHSA-rgr7-g85h-6v82

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-77hf-7fqf-f227

GHSA-77hf-7fqf-f227:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.1	2026.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a local Denial of Service in the openclaw package, caused by insecure extraction of .tar.bz2 archives. The root cause, identified from the security advisory and the patch 0dbb92dd2bcf9a32379d11c0f11ed016669dae3e, is that the code path for .tar.bz2 files in src/agents/skills-install-download.ts implemented its own extraction logic by shelling out to tar. This custom logic lacked the robust security checks present in the project's centralized archive extractor.

The analysis of the patch shows that the extractArchive function in src/agents/skills-install-download.ts was the site of the vulnerability. The original code performed minimal pre-flight checks, only looking for symbolic links, while ignoring other dangerous archive entries (like FIFOs) and failing to enforce file size limits. This allowed a malicious archive to cause a DoS.

The patch rectifies this by significantly hardening the pre-flight checks. It introduces new logic to parse detailed metadata from tar's verbose output, reuses a centralized createTarEntrySafetyChecker to validate each entry's type and size against security policies, and adds a TOCTOU (Time-of-Check to Time-of-Use) check by hashing the archive file before and after the safety validation to ensure it hasn't been modified in-between.

The two key functions identified are extractArchive, which contained the flawed logic, and installDownloadSkill, which is the higher-level API function that initiates the vulnerable process. Both would be present in a runtime profile during exploitation.

Vulnerable functions

extractArchive

src/agents/skills-install-download.ts

This function handles the extraction of skill archives. For `.tar.bz2` files, it shells out to the `tar` command. The vulnerability lies in the insufficient safety checks performed before extraction. The original implementation had basic checks for symbolic links but lacked validation for other dangerous entry types (like FIFOs, character devices) and did not enforce limits on the size of extracted files. This allowed a specially crafted `.tar.bz2` archive to cause a local denial-of-service by creating problematic files or exhausting disk space.

installDownloadSkill

src/agents/skills-install-download.ts

This function orchestrates the entire skill installation process, including downloading the specified archive and calling the `extractArchive` function to unpack it. As the entry point for the vulnerable workflow, it would appear in the stack trace during an exploit, as it's responsible for passing the untrusted archive data to the insecure extraction logic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.