GHSA-m34q-h93w-vg5x

Source

https://github.com/advisories/GHSA-m34q-h93w-vg5x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-m34q-h93w-vg5x/GHSA-m34q-h93w-vg5x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m34q-h93w-vg5x

Aliases

CVE-2026-41383

Downstream

MINI-5r5w-69xc-83mv

Published

2026-04-07T18:14:57Z

Modified

2026-04-28T18:17:19Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

Details

Summary

Before OpenClaw 2026.4.2, the OpenShell mirror backend accepted arbitrary absolute remoteWorkspaceDir and remoteAgentWorkspaceDir values. In mirror mode, those paths were then used as the target of remote cleanup and overwrite operations.

Impact

If an attacker could influence those OpenShell config values, mirror sync could delete the contents of an unintended remote directory and replace them with uploaded workspace data. This was a destructive remote-path bug in the mirror-sync path.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

b21c9840c2e38f4bb338d031511b479d5f07ca25 — constrain OpenShell mirror sync roots

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @jufeng123768 for reporting.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-07T18:14:57Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "nvd_published_at": null
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2026.4.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-m34q-h93w-vg5x/GHSA-m34q-h93w-vg5x.json"

last_known_affected_version_range

"<= 2026.4.1"