PT-2026-25418 · Npm · Openclaw

Published 2026-03-03 · Updated 2026-03-03

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

A path-confinement bypass in browser output handling allowed writes outside intended roots in openclaw versions up to and including 2026.3.1.

The fix unifies root-bound, file-descriptor-verified write semantics and canonical path-boundary validation across browser output and related install/skills write paths.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version at triage time: 2026.3.1
• Affected range: <= 2026.3.1
• Patched release: 2026.3.2 (released)

Fix Commit(s)

• 104d32bb64cdf19d5e77f70553a511a2ae90ad1c

Technical Notes

• Browser output writes now use root-bound, fd/inode-verified commit flow.
• Install + skills path checks now share canonical in-base validation to reduce drift and close equivalent escape surfaces.
• Added regression coverage for symlink-rebind and root-bound source-path write behavior.

Fix

Link Following

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-367

Related Identifiers

GHSA-3PXQ-F3CP-JMXP

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-3pxq-f3cp-jmxp · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3pxq-f3cp-jmxp · Note
• https://github.com/openclaw/openclaw/commit/104d32bb64cdf19d5e77f70553a511a2ae90ad1c · Note