N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jxrq-8fm4-9p58

GHSA-jxrq-8fm4-9p58: OpenClaw: Zip extraction symlink traversal could write outside destination

Summary

A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version at triage time: 2026.2.21-2
Affected versions: <= 2026.2.21-2
Planned patched version for next release: 2026.2.22

Technical Details

The vulnerable path was in src/infra/archive.ts ZIP extraction logic. Output-path checks were lexical, but writes could still traverse an existing symlink in destination path segments.

The fix blocks this by:

rejecting symlink traversal in destination path segments,
validating resolved destination paths remain inside the extraction root,
using no-follow file opens for ZIP output writes where supported,
adding a regression test for pre-seeded destination symlink traversal.

Impact

Type: Arbitrary file write outside extraction root via symlink traversal during ZIP extraction.
Preconditions: attacker-controlled archive extraction plus pre-existing symlink in destination path.

Fix Commit(s)

4b226b74f5fd3b106a83a6347fd404172e2fd246

Release Process Note

Patched version is pre-set to the planned next release (2026.2.22). Once npm release 2026.2.22 is published, the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jxrq-8fm4-9p58

GHSA-jxrq-8fm4-9p58:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.22	2026.2.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue within the ZIP extraction logic, specifically a 'Zip Slip' variant using symlinks. The analysis of the patch commit 4b226b74f5fd3b106a83a6347fd404172e2fd246 reveals that the core of the vulnerability lies in the extractZip function in src/infra/archive.ts. Before the patch, this function used createWriteStream from Node.js's fs module to write files from the archive to the disk. This function follows symbolic links, which is the root cause of the vulnerability. An attacker could create a ZIP file with an entry like link/to/outside/file.txt, and if link is a pre-existing symlink on the target filesystem pointing to a location outside the extraction directory (e.g., /), the file would be written to an arbitrary location. The patch addresses this by replacing the direct use of createWriteStream with a multi-layered defense: 1) It introduces assertNoSymlinkTraversal to iteratively check each component of the extraction path using fs.lstat to ensure no component is a symlink. 2) It adds assertResolvedInsideDestination to verify that the real, resolved path of the file to be written is within the intended destination. 3) Crucially, it replaces createWriteStream with a file handle opened via fs.open using the O_NOFOLLOW flag in the new openZipOutputFile function. This flag prevents the file-opening operation from following a symlink if it is the last component of the path. Therefore, the extractZip function is the vulnerable function as it contained the logic that processed the malicious archive and performed the unsafe file write.

Vulnerable functions

extractZip

src/infra/archive.ts

The `extractZip` function was vulnerable to a symlink traversal (Zip Slip) vulnerability. It used `createWriteStream(outPath)` to write extracted files. This function follows symlinks by default. If an attacker crafted a ZIP archive containing a file path that leveraged a pre-existing symlink on the filesystem, they could cause a file to be written outside of the intended destination directory. The vulnerable code did not check for symlinks within the extraction path, allowing this traversal.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-jxrq-8fm4-9p58: OpenClaw: Zip extraction symlink traversal could write outside destination

Summary

Affected Packages / Versions

Technical Details

Impact

Fix Commit(s)

Release Process Note

GHSA-jxrq-8fm4-9p58:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-jxrq-8fm4-9p58: OpenClaw: Zip extraction symlink traversal could write outside destination

Summary

Affected Packages / Versions

Technical Details

Impact

Fix Commit(s)

Release Process Note

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI