8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-r5fq-947m-xm57

GHSA-r5fq-947m-xm57: OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

Summary

In affected versions, when apply_patch was enabled and the agent ran without filesystem sandbox containment, crafted paths could cause file writes/deletes outside the configured workspace directory.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.13
Fixed: >= 2026.2.14

Details

The non-sandbox path resolution in apply_patch did not enforce workspace containment. Inputs like ../../... or absolute paths could escape the working directory in non-sandboxed mode.

Impact

Practical impact depends on deployment and who can trigger tool execution. This is most relevant when tool invocation is exposed to less-trusted callers or when operators expected workspace-only containment.

Workarounds

Keep tools.exec.applyPatch.enabled disabled if you do not need apply_patch.
Keep tools.exec.applyPatch.workspaceOnly at its secure default of true.
Restrict who can trigger tool execution (and which tools are allowlisted).

Configuration Note

tools.exec.applyPatch.workspaceOnly: false intentionally opts out of workspace containment and can re-enable outside-workspace writes/deletes.

Fix

PR: https://github.com/openclaw/openclaw/pull/16405
Merge commit: 5544646a09c0121fca7d7093812dc2de8437c7f1

Credits

Thanks to @p80n-sec for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-r5fq-947m-xm57

GHSA-r5fq-947m-xm57:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal weakness in the apply_patch functionality of the OpenClaw agent. The root cause was located in the resolvePathFromCwd function within src/agents/apply-patch.ts. This function was responsible for resolving file paths specified in a patch file but failed to enforce that the resulting path remained within the designated workspace directory. It improperly handled relative path sequences (../) and absolute paths, allowing an attacker to craft a patch that could write to or delete arbitrary files on the filesystem where the agent was running.

The patch remediates this vulnerability by removing the insecure, custom path-handling logic found in resolvePathFromCwd and expandPath. It replaces the call in resolvePatchPath with a new, secure function, assertSandboxPath. This function explicitly validates that the target file path is contained within the workspace root, effectively preventing any traversal outside of it. The primary runtime indicator of this vulnerability being exploited would be the applyPatch function, as it is the main entry point that processes the malicious patch and subsequently calls the vulnerable path resolution logic.

Vulnerable functions

resolvePathFromCwd

src/agents/apply-patch.ts

This function was responsible for resolving file paths. It was vulnerable to path traversal because it did not prevent relative paths (`../`) from escaping the current working directory (`cwd`) and allowed absolute paths to be used without restriction. The entire function was removed as part of the fix.

expandPath

src/agents/apply-patch.ts

This helper function expanded tilde (`~`) paths to the user's home directory. This contributed to the vulnerability by allowing patches to reference paths outside the intended workspace, which were then resolved by the insecure `resolvePathFromCwd` function. This function was removed in the patch.

resolvePatchPath

src/agents/apply-patch.ts

This function served as a bridge to the vulnerable path resolution logic. It directly called the insecure `resolvePathFromCwd` function to determine the final file path for patch operations. The patch replaced this call with `assertSandboxPath` to enforce workspace boundaries.

applyPatch

src/agents/apply-patch.ts

This is the main, user-facing function for the `apply_patch` tool. It orchestrates the entire process, including calling `resolvePatchPath` to get the target file location. An exploit would be triggered by calling this function with a maliciously crafted patch file, making it the primary function that would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.8

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-r5fq-947m-xm57: OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

Summary

Affected Packages / Versions

Details

Impact

Workarounds

Configuration Note

Fix

Credits

GHSA-r5fq-947m-xm57:

8.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-r5fq-947m-xm57: OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

Summary

Affected Packages / Versions

Details

Impact

Workarounds

Configuration Note

Fix

Credits

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.8

8.8

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI