Executive brief
OpenClaw is an AI automation runtime that executes tasks on user systems. A flaw in its file-system sandbox allowed attackers to bypass workspace boundary restrictions by using @-prefixed absolute paths (e.g., @/etc/passwd), potentially reading sensitive files outside the intended workspace. The vulnerability only affects users who explicitly enable the workspace-only sandbox mode, reducing real-world exposure.
Technical details
The vulnerability is a path traversal flaw (CWE-22) combined with validation-before-canonicalization (CWE-180). The root cause is that the sandbox guard checks @-prefixed absolute paths during validation before canonicalizing the path prefix, but the runtime normalizes the prefix differently during actual path resolution, allowing the path to resolve outside the workspace boundary. The attack vector requires enabling the non-default tools.fs.workspaceOnly=true configuration and crafting @-prefixed paths like @/etc/passwd. No authentication is required if the configuration is enabled. The flaw permits unauthorized file reads when the affected code paths are triggered. The fix normalizes @-prefixed paths before workspace-boundary checks (commit 9ef0fc2). A patch was released in version 2026.2.24.
Affected products
- OpenClaw openclaw <= 2026.2.23
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: Version 2026.2.24 released on npm
- 2026-03-03: advisory
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj
- https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-path-traversal-via-prefixed-absolute-paths-in-workspace-boundary-validation