Executive brief
OpenClaw is a skills and tools management system that downloads and installs skill packages. A local attacker can exploit a race condition in the skills download installer to redirect file writes outside the intended tools directory, potentially overwriting arbitrary files on the system.
Technical details
OpenClaw's skills-install-download function contains a time-of-check time-of-use (TOCTOU) race condition. The installer validates the intended tools-root path lexically but reuses that mutable path reference later during archive download and extraction. An attacker with local access can rebind the tools-root filesystem path between the validation check and the actual write operation, redirecting the installer to write files outside the intended tools directory. This is a path traversal vulnerability enabled by insufficient path canonicalization. The fix (version 2026.3.8) pins the canonical tools root immediately after validation and derives all subsequent paths from that immutable canonical path, preventing rebinding attacks. Patch availability: OpenClaw 2026.3.8 and later.
Affected products
- OpenClaw openclaw <= 2026.3.7
Timeline
- 2026-03-12: disclosed: GHSA-vhwf-4x96-vqx2 published
- 2026-03-08: patched: Fix released in version 2026.3.8