HighVulnerability
GHSA-659f-22xc-98f2: OpenClaw hook transform path containment missed symlink-resolved escapes
- Identifier
- GHSA-659f-22xc-98f2
- Published
- Record updated
- Affected
- openclaw <= 2026.2.21-2
- Fixed in
- 2026.2.22
- released February 22, 2026, 8 days before disclosure
Summary
The openclaw npm package, versions up to and including 2026.2.21-2, validated webhook transform modules with lexical path checks only. A symlink under the hooks transform tree could resolve outside the trusted directory and be dynamically imported, so the gateway may run unintended JavaScript with gateway-process privileges. Exploitation requires enabled, reachable hook transforms and an attacker able to influence transform path resolution.
Mitigation
Enforce realpath-aware containment for existing path ancestors before dynamic import, while keeping the lexical containment checks. The fix is planned for 2026.2.22, and the fix commit is f4dd0577b055f77af783105bd65eae32f3d5e6a1.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online