MediumVulnerability
GHSA-r6h2-5gqq-v5v6: OpenClaw: Reject symlinks in local skill packaging script
- Identifiers
- CVE-2026-27485GHSA-r6h2-5gqq-v5v6
- Published
- Record updated
- Affected
- openclaw <= 2026.2.18
- Fixed in
- 2026.2.19
- released February 19, 2026, 1 day before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
A local helper script in OpenClaw, `skills/skill-creator/scripts/package_skill.py`, followed symlinks while building `.skill` archives. When an author runs it on a crafted skill directory containing symlinks to files outside the skill root, the archive can include unintended file contents. The issue affects `openclaw` (npm) versions `<= 2026.2.17` and is rated Low severity, since it requires local execution and is not reachable through the gateway or chat runtime.
Mitigation
Reject symlinks during skill packaging, add regression tests for symlink file and symlink directory cases, and update packaging guidance to document the symlink restriction. The planned patched version is 2026.2.18.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online