GHSA-33hm-cq8r-wc49

Source

https://github.com/advisories/GHSA-33hm-cq8r-wc49

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-33hm-cq8r-wc49/GHSA-33hm-cq8r-wc49.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-33hm-cq8r-wc49

Aliases

CVE-2026-32026

Downstream

MINI-wvfq-w99f-5fjr

Published

2026-03-03T18:11:16Z

Modified

2026-03-20T21:16:25.950889Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N CVSS Calculator

Summary

Temporary path handling could write outside OpenClaw temp boundary

Details

Summary

Sandbox media local-path validation accepted absolute paths under host tmp, even when those paths were outside the active sandbox root.

Affected Packages / Versions

Package: openclaw (npm)
Latest published version verified during triage: 2026.2.23
Affected versions: <= 2026.2.23
Patched versions (planned next release): >= 2026.2.24

Details

In affected versions, sandbox media path resolution allowed absolute host tmp paths as trusted media inputs when they were under os.tmpdir(), without requiring that the path stay within the active sandboxRoot. Because outbound attachment hydration consumed these paths as already validated, this enabled out-of-sandbox host tmp file reads and exfiltration through attachment delivery.

Impact

Confidentiality impact: high for deployments relying on sandboxRoot as a strict local filesystem boundary.
Practical impact: attacker-controlled media references could read and attach host tmp files outside the sandbox workspace boundary.

Remediation

Restrict sandbox tmp-path acceptance to OpenClaw-managed temp roots only.
Default SDK/extension temp helpers to OpenClaw-managed temp roots.
Add CI guardrails to prevent broad tmp-root regressions in messaging/channel code paths.

Fix Commit(s)

d3da67c7a9b463edc1a9b1c1f7af107a34ca32f5
79a7b3d22ef92e36a4031093d80a0acb0d82f351
def993dbd843ff28f2b3bad5cc24603874ba9f1e

Release Process Note

The advisory is pre-set with patched version 2026.2.24 so it is ready for publication once that npm release is available.

OpenClaw thanks @tdjackey for reporting.

Publication Update (2026-02-25)

openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T18:11:16Z",
    "severity": "MODERATE",
    "nvd_published_at": "2026-03-19T22:16:37Z",
    "cwe_ids": [
        "CWE-22",
        "CWE-284"
    ]
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2026.2.24

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-33hm-cq8r-wc49/GHSA-33hm-cq8r-wc49.json"

last_known_affected_version_range

"<= 2026.2.23"