GHSA-35mw-5vvr-vrxc

OpenClaw contains a symlink traversal vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-43570

Packages

Ecosystem	Package	Affected	Fixed in
npm	openclaw	>= 2026.3.22, < 2026.4.5	2026.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.

References

External links from the advisory. They lead to third-party sites.

https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6 web
https://nvd.nist.gov/vuln/detail/CVE-2026-43570 advisory
https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c537f3a web
https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538edaeae web
https://github.com/openclaw/openclaw package
https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marketplace-repository-path-handling web