{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@gitlawb/openclaude"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-21T15:16:16Z",
    "nvd_published_at": "2026-04-21T00:16:28Z",
    "severity": "HIGH"
  },
  "details": "A logic flaw exists in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an `allow` result immediately \u2014 before the path constraint filter (`checkPathConstraints`) is ever evaluated. This allows commands containing path traversal sequences (e.g., `../../../../../etc/passwd`) to bypass directory restrictions entirely.\n\n## Affected Component\n\n- **File:** `src/tools/BashTool/bashPermissions.ts`\n- **Function:** `bashToolHasPermission`\n- **Location:** ~line 1445 (sandbox auto-allow block)\n\n## Vulnerable Code Flow\n\n```\nbashToolHasPermission()\n    \u2502\n    \u251c\u2500 [~1445] Sandbox auto-allow block\n    \u2502       \u2514\u2500 No deny rule found \u2192 return ALLOW  \u26a0\ufe0f Early exit\n    \u2502\n    \u2514\u2500 [~1644] checkPathConstraints()             \u274c Never reached\n```\n\nThe sandbox block was designed to skip interactive permission prompts in sandboxed environments. However, it unintentionally also skips the path traversal filter, which is a separate and critical security control.\n\n## Impact\n\nAny process or user operating in a sandboxed session with no explicit deny rules can:\n\n- Read arbitrary files outside the sandbox boundary (e.g., `/etc/passwd`, `/etc/shadow`, `.env` files, SSH private keys)\n- Write to arbitrary paths (subject to OS-level permissions)\n- Fully defeat the filesystem isolation that the sandbox is intended to enforce\n\n## Steps to Reproduce\n\n1. Enable sandbox mode: `SandboxManager.isSandboxingEnabled() = true`\n2. Enable auto-allow: `SandboxManager.isAutoAllowBashIfSandboxedEnabled() = true`\n3. Ensure no explicit deny rules are configured for the session\n4. Submit a bash command with a path traversal payload:\n   ```\n   cat ../../../../../etc/passwd\n   ```\n5. Observe that the command receives `behavior: allow` without triggering `checkPathConstraints`\n\n## Recommended Fix\n\nThe sandbox auto-allow block should **never short-circuit the full permission pipeline**. It may suppress interactive prompts, but path constraint validation must always execute.\n\n### Option 1 \u2014 Preferred: Continue pipeline on `allow`\n\nOnly return early for `deny` or `ask` behaviors. Let `allow` fall through to `checkPathConstraints`:\n\n```typescript\nif (\n  SandboxManager.isSandboxingEnabled() \u0026\u0026\n  SandboxManager.isAutoAllowBashIfSandboxedEnabled() \u0026\u0026\n  shouldUseSandbox(input)\n) {\n  const sandboxAutoAllowResult = checkSandboxAutoAllow(\n    input,\n    appState.toolPermissionContext,\n  );\n  if (sandboxAutoAllowResult.behavior !== \u0027allow\u0027) {\n    // Only block or prompt \u2014 never skip path checks on allow\n    return sandboxAutoAllowResult;\n  }\n  // If \u0027allow\u0027, continue to checkPathConstraints below\n}\n```\n\n### Option 2 \u2014 Defense in depth: Run path check before returning\n\nRun `checkPathConstraints` explicitly inside the sandbox block before returning:\n\n```typescript\nif (sandboxAutoAllowResult.behavior !== \u0027passthrough\u0027) {\n  const pathCheck = checkPathConstraints(input, appState.toolPermissionContext);\n  if (pathCheck.behavior !== \u0027allow\u0027) {\n    return pathCheck; // Block traversal attempts even in sandbox\n  }\n  return sandboxAutoAllowResult;\n}\n```\n\n### Option 3 \u2014 Minimal change: Move sandbox block after path check\n\nReorder the function so `checkPathConstraints` always runs first, and the sandbox block only handles the prompt-suppression logic afterward.\n\n---\n\nCredit: Elvin Latifli (@Rickidevs )",
  "id": "GHSA-m6rx-7pvw-2f73",
  "modified": "2026-04-21T15:16:16Z",
  "published": "2026-04-21T15:16:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m6rx-7pvw-2f73"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35570"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gitlawb/openclaude/commit/7002cb302b78ea2a19da3f26226de24e2903fa1d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Gitlawb/openclaude"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal "
}