CVE-2026-43567 — OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter

Affected: OpenClaw

OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.

GHSA-jf25-7968-h2h5 — OpenClaw: screen_record outPath bypassed workspace-only filesystem guard

Affected: npm: openclaw

## Summary

screen_record outPath bypassed workspace-only filesystem guard.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The node-host screen recording tool could honor an `outPath` outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.

## Technical Details

The fix applies the workspace-root guard to node tool `outPath` handling, including screen recording paths.

## Fix

The issue was fixed in #63551. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `635bb35b68d8faa5bfa2fda35feadd315122748a` - PR: #63551

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @anshumanbh for reporting this issue.

Most recent entries from all

CVE-2026-43567 — OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter

GHSA-jf25-7968-h2h5 — OpenClaw: screen_record outPath bypassed workspace-only filesystem guard