PT-2026-25421 · Npm · Openclaw

Publicado

2026-03-03

·

Atualizado

2026-03-03

CVSS v4.0

4.8

Média

VetorAV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Summary

Sandbox browser container launched Chromium with --no-sandbox by default, disabling Chromium's OS-level sandbox protections.

Affected Packages / Versions

  • Package: openclaw (npm ecosystem)
  • Latest published npm version at triage time (2026-02-21): 2026.2.19-2
  • Affected range: <= 2026.2.19-2
  • Planned patched version for next release: 2026.2.21

Impact

When --no-sandbox is enabled by default, renderer compromise no longer requires a separate sandbox escape. This weakens container browser isolation and increases impact from renderer-side bugs.

Resolution

  • Default --no-sandbox removed from sandbox browser entrypoint.
  • Explicit opt-in added via OPENCLAW BROWSER NO SANDBOX / CLAWDBOT BROWSER NO SANDBOX.
  • Browser container hash migration + security audit checks added so stale containers are surfaced and can be recreated safely.

Fix Commit(s)

  • e7eba01efc4c3c400e9cfd3ce3d661cbc788a631
  • 1835dec2004fe7a62c6a7ba46b8485f124ec6199

Release Process Note

The advisory patched versions field is pre-set to the planned next release (2026.2.21). After npm release publication, only advisory publish action should remain.
OpenClaw thanks @TerminalsandCoffee for reporting.

Correção

Protection Mechanism Failure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-693

Identificadores relacionados

GHSA-43X4-G22P-3HRQ

Produtos afetados

Openclaw