N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-cwf8-44x6-32c2

GHSA-cwf8-44x6-32c2: OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal

Summary

OpenShell Mirror Sync: Sandbox Escape via Unrestricted File Sync + Symlink Traversal

Current Maintainer Triage

Status: narrow
Normalized severity: high
Assessment: v2026.3.28 still has the mirror-boundary bug because shipped c02ee8 only excluded hooks while unreleased 3b9dab is the first full symlink-free upload and download hardening.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

c02ee8a3a4cb390b23afdf21317aa8b2096854d1 — 2026-03-25T19:59:07Z
3b9dab0ece4643a9643e6a45459f5c709d3ce320 — 2026-03-30T14:51:44+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-cwf8-44x6-32c2

GHSA-cwf8-44x6-32c2:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw's OpenShell Mirror Sync stems from improper handling of symbolic links and insufficient path validation during file synchronization between the host and a remote sandbox. This created a sandbox escape vector. The analysis of the patch commits reveals two primary attack surfaces:

Symlink Traversal on Download: The replaceDirectoryContents function, which is called by OpenShellSandboxBackendImpl.syncWorkspaceFromRemote, was used to mirror a remote sandbox directory to the local host. The original implementation did not correctly handle symbolic links within the sandbox. An attacker could create a symlink in the sandbox pointing to an arbitrary path on the host filesystem (e.g., ../../../../etc/passwd). When the sync operation occurred, the application would traverse this symlink and write content to the specified host path, leading to arbitrary file write outside the intended workspace.
Symlink Traversal on Upload: The OpenShellSandboxBackendImpl.uploadPathToRemote function was responsible for uploading local files to the sandbox. It directly uploaded the provided path. If a malicious actor could place a symbolic link within the directory being uploaded that pointed to a sensitive file on the host (e.g., ~/.ssh/id_rsa), the upload process would dereference the link and exfiltrate the sensitive file to the attacker's sandbox.

The initial fix (c02ee8a) attempted to mitigate part of the issue by preventing the hooks/ directory from being synced, which could lead to remote code execution. However, the core symlink traversal vulnerability remained. The complete fix (3b9dab) addresses the root cause by introducing a new copyTreeWithoutSymlinks utility that explicitly checks for and ignores symlinks during copy operations. This hardened function is now used by replaceDirectoryContents (for downloads) and a new stageDirectoryContents function (for uploads) to ensure that file operations are strictly confined within the workspace boundaries, preventing path traversal attacks in both directions.

Vulnerable functions

replaceDirectoryContents

extensions/openshell/src/mirror.ts

This function was vulnerable to symlink traversal. When syncing content from a remote sandbox, a malicious symbolic link in the source directory could point to a location outside the intended target directory on the host. The original implementation using `fs.cp` was replaced with `copyTreeWithoutSymlinks`, which explicitly checks for and ignores symbolic links, preventing the traversal. Additionally, it initially lacked directory exclusion, allowing an attacker to overwrite sensitive host directories like `hooks/`.

OpenShellSandboxBackendImpl.uploadPathToRemote

extensions/openshell/src/backend.ts

The original implementation of this function directly uploaded the specified `localPath` to the remote sandbox. If this path contained a symbolic link pointing to a sensitive file or directory on the host system (e.g., `~/.ssh`), the upload process would dereference the link and exfiltrate the sensitive content to the attacker-controlled sandbox. The patch mitigates this by first staging the content into a temporary directory using `stageDirectoryContents`, which creates a copy without any symbolic links, and then uploading the sanitized temporary directory.

OpenShellSandboxBackendImpl.syncWorkspaceFromRemote

extensions/openshell/src/backend.ts

This function orchestrates the synchronization of the workspace from the remote sandbox by calling `replaceDirectoryContents`. It was vulnerable because it initiated the process that was susceptible to symlink traversal and did not initially exclude sensitive directories, allowing an attacker to write files outside the workspace and potentially achieve code execution by overwriting hook files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.