https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T14:36:47.878466+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-43567 BREW-openclaw-cli-CVE-2026-43567 — OpenClaw: screen_record outPath bypassed workspace-only filesystem guard 2026-09-29T14:36:47.879549+00:00

Affected: Homebrew: openclaw-cli

## Summary

screen_record outPath bypassed workspace-only filesystem guard.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The node-host screen recording tool could honor an `outPath` outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.

## Technical Details

The fix applies the workspace-root guard to node tool `outPath` handling, including screen recording paths.

## Fix

The issue was fixed in #63551. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `635bb35b68d8faa5bfa2fda35feadd315122748a` - PR: #63551

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @anshumanbh for reporting this issue.

 https://db.gcve.eu/vuln/cve-2026-43567 CVE-2026-43567 — OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter 2026-09-29T14:36:47.879621+00:00

Affected: OpenClaw

OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.