N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-fv94-qvg8-xqpw

GHSA-fv94-qvg8-xqpw: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

Summary

SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

Current Maintainer Triage

Status: open
Normalized severity: high
Assessment: Real in shipped v2026.3.28: SSH sandbox tar upload lacked pre-upload symlink escape rejection until 3d5af14984 on 2026-03-31; maintainers already accepted it and the fix is unreleased.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

3d5af14984ac1976c747a8e11581d697bd0829dc — 2026-03-31T19:56:45+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-fv94-qvg8-xqpw

GHSA-fv94-qvg8-xqpw:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the openclaw package and allows an attacker to read arbitrary files from the host system and write them to a remote SSH target. This is due to a lack of validation for symbolic links in the uploadDirectoryToSshTarget function located in src/agents/sandbox/ssh.ts.

The patch introduces a new function, assertSafeUploadSymlinks, which is called at the beginning of uploadDirectoryToSshTarget. This new function recursively scans the directory to be uploaded and verifies that no symbolic links point outside of the directory's root. If an escaping symlink is found, an error is thrown, and the upload process is aborted.

The vulnerable function is uploadDirectoryToSshTarget because it was the function that handled the directory upload without proper validation. During an exploit, this function would be present in the runtime profile or stack trace as it processes the malicious directory.

Vulnerable functions

uploadDirectoryToSshTarget

src/agents/sandbox/ssh.ts

The `uploadDirectoryToSshTarget` function is responsible for uploading a local directory to a remote SSH host. The vulnerability lies in the fact that, before the patch, this function did not check for symbolic links within the directory that could point to files or directories outside of the intended directory structure. An attacker could create a malicious directory containing a symlink to a sensitive file on the host system (e.g., `/etc/passwd`). When this directory was processed by `uploadDirectoryToSshTarget`, the underlying archiving tool (`tar`) would follow the symlink, including the sensitive file in the archive. This archive was then sent to the remote host, resulting in an arbitrary file being read from the machine running the agent and written to the remote sandbox.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.