PT-2026-34786 · Openshell · Openshell

Tdjackey · Published 2026-04-07 · Updated 2026-05-12 · CVE-2026-41355

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenShell versions prior to 2026.3.28

Description An arbitrary code execution issue exists in mirror mode, which allows untrusted sandbox files to be converted into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host system during gateway startup by exploiting enabled workspace hooks.

Recommendations Update to version 2026.3.28.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-41355

GHSA-42MX-VP8M-J7QH

GHSA-M563-373Q-885C

Affected Products

Openshell

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-42mx-vp8m-j7qh · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1 · Patch
• https://osv.dev/vulnerability/GHSA-42mx-vp8m-j7qh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m563-373q-885c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41355 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openshell-arbitrary-code-execution-via-mirror-mode-sandbox-file-conversion · Note
• https://t.me/cveNotify/163159 · Telegram Post
• https://twitter.com/CVEnew/status/2048168353710420007 · Twitter Post