AI agent vulnerability · OpenClaw

GHSA-7xmq-g46g-f8pv: OpenClaw: Sandbox media TOCTOU could read files outside sandbox root

highCVSS 4.0 8.7

Summary Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside sandboxRoot. Impact Affected versions could permit host file reads outside the intended sandbox root in media attachment/image flows.

Published Mar 2, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.3.1
Fixed in: 2026.3.1
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside sandboxRoot.

Impact

Affected versions could permit host file reads outside the intended sandbox root in media attachment/image flows.

Fix

Media reads now use consolidated root-scoped, boundary-safe read paths at use time, removing check/use drift across call sites.

Affected and Patched Versions

Affected: <= 2026.2.26
Patched: 2026.3.1

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries