GHSA-659F-22XC-98F2

Vulnerability from github – Published: 2026-03-03 23:00 – Updated: 2026-03-03 23:00
VLAI
Summary
OpenClaw hook transform path containment missed symlink-resolved escapes
Details

Vulnerability

Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.21-2
  • Patched version (planned next release): 2026.2.22

Impact

When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges.

Attack Preconditions

  • Hook transforms are enabled and reachable.
  • Attacker can influence transform path resolution (for example via privileged config access and/or writable filesystem path in the transform tree).
  • A symlink escape exists to attacker-controlled code.

Remediation

  • Enforce realpath-aware containment for existing path ancestors before dynamic import.
  • Keep lexical containment checks for traversal and absolute-path escapes.
  • Add regression coverage for:
  • transform module symlink escape rejection,
  • hooks.transformsDir symlink escape rejection,
  • in-root symlink allow-case.

Fix Commit(s)

  • f4dd0577b055f77af783105bd65eae32f3d5e6a1

OpenClaw thanks @aether-ai-agent for reporting.

Severity
7.3 (High)
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.2.21-2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T23:00:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Vulnerability\n\nWebhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.21-2`\n- Patched version (planned next release): `2026.2.22`\n\n## Impact\n\nWhen an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges.\n\n## Attack Preconditions\n\n- Hook transforms are enabled and reachable.\n- Attacker can influence transform path resolution (for example via privileged config access and/or writable filesystem path in the transform tree).\n- A symlink escape exists to attacker-controlled code.\n\n## Remediation\n\n- Enforce realpath-aware containment for existing path ancestors before dynamic import.\n- Keep lexical containment checks for traversal and absolute-path escapes.\n- Add regression coverage for:\n  - transform module symlink escape rejection,\n  - `hooks.transformsDir` symlink escape rejection,\n  - in-root symlink allow-case.\n\n## Fix Commit(s)\n\n- `f4dd0577b055f77af783105bd65eae32f3d5e6a1`\n\nOpenClaw thanks @aether-ai-agent for reporting.",
  "id": "GHSA-659f-22xc-98f2",
  "modified": "2026-03-03T23:00:53Z",
  "published": "2026-03-03T23:00:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-659f-22xc-98f2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/f4dd0577b055f77af783105bd65eae32f3d5e6a1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw hook transform path containment missed symlink-resolved escapes"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.