AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass | Endor Labs

Summary

Endor Labs' AI SAST engine found GHSA-r5fq-947m-xm57, a high-severity (CVSS 8.8) path traversal in OpenClaw's apply_patch tool, affecting openclaw versions up to 2026.2.13. When sandboxRoot is not configured, as in the default for non-containerized deployments, resolvePathFromCwd() passes attacker-controlled patch paths to file system writes and deletes without a containment check, allowing arbitrary file writes and deletes outside the workspace. Exploitation requires the LLM to emit the malicious tool call, and the author reports that most of 10 bypass attempts were blocked by the model's safety behavior.

Mitigation

Fixed in OpenClaw. The package is listed as patched; the source does not state the fixed version or specific configuration change.

Related items

• InfoChatGPT Plus for veterans and servicemembersSame vendor · OpenAI Blog
• InfoBenchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models | Endor LabsSame vendor · Endor Labs Blog
• InfoAnthropic opens Australian retail IPO offering as AI scrutiny intensifies Same vendor · CNBC Technology
• InfoChatGPT is getting verified AI ‘Business Agents’Same vendor · The Verge (AI)
• InfoAnthropic set for $1.3tn stock market debut despite 'catastrophic' AI warningSame vendor · BBC Technology