N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-m34q-h93w-vg5x

GHSA-m34q-h93w-vg5x: OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

Summary

Before OpenClaw 2026.4.2, the OpenShell mirror backend accepted arbitrary absolute remoteWorkspaceDir and remoteAgentWorkspaceDir values. In mirror mode, those paths were then used as the target of remote cleanup and overwrite operations.

Impact

If an attacker could influence those OpenShell config values, mirror sync could delete the contents of an unintended remote directory and replace them with uploaded workspace data. This was a destructive remote-path bug in the mirror-sync path.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

b21c9840c2e38f4bb338d031511b479d5f07ca25 — constrain OpenShell mirror sync roots

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @jufeng123768 for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-m34q-h93w-vg5x

GHSA-m34q-h93w-vg5x:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in the openclaw package's OpenShell mirror backend. The root cause is the normalizeRemotePath function in extensions/openshell/src/config.ts, which failed to properly sanitize the remoteWorkspaceDir and remoteAgentWorkspaceDir configuration parameters. The function only checked if the path was absolute, without ensuring it was confined to a safe directory like /sandbox or /agent. This allowed an attacker who could control the OpenShell configuration to use path-traversal payloads (e.g., /sandbox/../../tmp/foo) to target arbitrary directories on the remote machine for deletion and overwriting during a mirror sync. The patch rectifies this by introducing normalizeOpenShellRemotePath, a new function that validates whether the path is within the allowed directories. The resolveOpenShellPluginConfig function, which uses these parameters, was updated to call the new, secure function. Consequently, both resolveOpenShellPluginConfig and the original normalizeRemotePath would be visible in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

normalizeRemotePath

extensions/openshell/src/config.ts

This function was vulnerable because it only checked if a path was absolute but did not restrict it to a safe directory. An attacker could provide a path-traversal payload (e.g., `/../`) to point to an arbitrary directory on the remote system. The `path.posix.normalize` function would resolve this path, but no validation was in place to prevent it from pointing outside the intended workspace directories.

resolveOpenShellPluginConfig

extensions/openshell/src/config.ts

This function serves as the entry point for the vulnerability. It processes the OpenShell plugin configuration, which an attacker could potentially influence, and passes the `remoteWorkspaceDir` and `remoteAgentWorkspaceDir` values to the vulnerable `normalizeRemotePath` function. By handling potentially malicious input and forwarding it to the vulnerable function, `resolveOpenShellPluginConfig` is a key component of the vulnerable execution flow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.