CVE-2026-100542

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100542
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100542.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100542
Aliases
  • GHSA-6xpv-wwr5-265h
Published
2026-09-26T02:18:39Z
Modified
2026-09-26T11:47:28Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
Details

OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100542.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
e93216080aa1f425d3ab127014603eba8e365b2d
Fixed
ea806575e6450e4d1efdfc72c19f04be982a1b9b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2026.5.28"
        },
        {
            "fixed":  "2026.8.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100542.json"