PT-2026-25512 · Npm · Openclaw

Published 2026-03-04 · Updated 2026-03-04

OSV

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

In certain workspace-restricted configurations, OpenClaw could follow hardlink aliases inside the workspace that reference files outside the workspace boundary.

By default, tools.fs.workspaceOnly is off. This primarily affects deployments that intentionally enable workspace-only filesystem restrictions (and workspace-only apply patch checks).

Impact

• Confidentiality: out-of-workspace files could be read through in-workspace hardlink aliases.
• Integrity: out-of-workspace files could be modified through in-workspace hardlink aliases.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published version at triage time: 2026.2.24
• Affected range: <= 2026.2.24
• Planned patched version: 2026.2.25

Fix Commit(s)

• 04d91d0319b82fd4de91ed05e9fc5219ff2ab64e (main)

Remediation

OpenClaw now rejects hardlinked final-file aliases during workspace boundary validation for:

• workspace-only path checks (read / write / edit)
• workspace-only apply patch read/write paths
• sandbox mount-root path-safety checks

Regression tests were added for apply patch, workspace fs tools, and sandbox fs bridge hardlink alias escapes.

OpenClaw thanks @tdjackey for reporting.

Fix

Link Following

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-59

CWE-668

Related Identifiers

GHSA-3JX4-Q2M7-R496

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-3jx4-q2m7-r496 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/04d91d0319b82fd4de91ed05e9fc5219ff2ab64e · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3jx4-q2m7-r496 · Note