N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7xmq-g46g-f8pv

GHSA-7xmq-g46g-f8pv: OpenClaw: Sandbox media TOCTOU could read files outside sandbox root

Summary

Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside sandboxRoot.

Impact

Affected versions could permit host file reads outside the intended sandbox root in media attachment/image flows.

Fix

Media reads now use consolidated root-scoped, boundary-safe read paths at use time, removing check/use drift across call sites.

Affected and Patched Versions

Affected: <= 2026.2.26
Patched: 2026.3.1

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7xmq-g46g-f8pv

GHSA-7xmq-g46g-f8pv:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.3.1	2026.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Time-of-check Time-of-use (TOCTOU) race condition in how media files and attachments are handled within the sandbox. The application would first check if a file path was within the designated sandbox directory and then, in a separate operation, read the file from that path. This created a window of opportunity for an attacker to replace the validated path with a symbolic link pointing to a sensitive file outside the sandbox. When the application proceeded to read the file, it would follow the symlink and read the unintended file.

The patch addresses this by replacing the separate check-and-read operations with a single, more atomic function, readFileWithinRoot, which is used by a new factory function createRootScopedReadFile. This new function ensures that the file being read is the same one that was validated, effectively closing the race condition window. The analysis identified several functions across the codebase that were using the vulnerable check-then-read pattern and were updated in the patch to use the new, safer file reading mechanism. These functions are involved in serving media, processing attachments, and handling image-related tools, all of which deal with file paths that could be manipulated by an attacker.

Vulnerable functions

createHostEditOperations.readFile

src/agents/pi-tools.read.ts

The `readFile` function within `createHostEditOperations` was vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. It first validated the file path using `openFileWithinRoot` and then read the file in a separate step. An attacker could change the file path to a symlink pointing outside the intended directory between these two operations, leading to arbitrary file reads.

hydrateAttachmentParamsForAction

src/infra/outbound/message-action-params.ts

The `hydrateAttachmentParamsForAction` function, through `buildAttachmentMediaLoadOptions`, used an unsafe `fs.readFile` for sandboxed media. This was vulnerable to a TOCTOU race condition where a symlink could be manipulated after path validation but before the read, allowing access to files outside the sandbox. The patch replaces this with a root-scoped safe reader.

attachMediaRoutes

src/media/server.ts

The route handler within `attachMediaRoutes` for serving media files was vulnerable to a TOCTOU race condition. It used `openFileWithinRoot` to check the path and then `handle.readFile()` to read the file. This separation allowed for a symlink attack between the check and the read, enabling arbitrary file access. The patch consolidates this into a single `readFileWithinRoot` call.

loadImageFromRef

src/agents/pi-embedded-runner/run/images.ts

When loading an image from a sandboxed path, `loadImageFromRef` passed a `readFile` function to `loadWebMedia` that was vulnerable to a TOCTOU race condition. The path was validated, but the subsequent read operation could be redirected via a symlink to a file outside the sandbox. The patch replaces this with a safer, consolidated read function.

createImageTool

src/agents/tools/image-tool.ts

Similar to `loadImageFromRef`, the `createImageTool` function used a `readFile` implementation for sandboxed paths that was vulnerable to a TOCTOU race condition. An attacker could exploit the time between path validation and file reading to read files outside the intended sandbox by using a symlink.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-7xmq-g46g-f8pv: OpenClaw: Sandbox media TOCTOU could read files outside sandbox root

Summary

Impact

Fix

Affected and Patched Versions

GHSA-7xmq-g46g-f8pv:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

GHSA-7xmq-g46g-f8pv: OpenClaw: Sandbox media TOCTOU could read files outside sandbox root

Summary

Impact

Fix

Affected and Patched Versions

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI