CVE-2026-35570: OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal

CVE-2026-35570 · Severity: high · CVSS 8.4 · Published 2026-04-21

OpenClaude is a code assistant framework that uses sandboxing to restrict bash command execution to a safe directory. A logic flaw in the permission check allows attackers with sandbox access to bypass directory restrictions using path traversal sequences (e.g., ../../../etc/passwd), enabling them to read sensitive files like .env files, SSH keys, and system files outside the intended sandbox boundary. This undermines the core filesystem isolation that the sandbox is designed to provide.

Vendors: npm.

Quick answers

Is CVE-2026-35570 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35570 being exploited in the wild.
How severe is CVE-2026-35570?
High severity, with a CVSS score of 8.4, published 21 April 2026.
Which products and versions are affected?
@gitlawb/openclaude (npm) < 0.5.1, SEMVER:introduced=0,fixed=0.5.1.
Is there a fix for CVE-2026-35570?
Yes. @gitlawb/openclaude (npm): upgrade to 0.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35570 attacked?
It is attacked with local access.
Am I affected by CVE-2026-35570?
Check whether you run Gitlawb Openclaude or @gitlawb/openclaude (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @gitlawb/openclaude (npm): upgrade to 0.5.1 or later
    npm install @gitlawb/openclaude@0.5.1

Technical details

The vulnerability exists in bashToolHasPermission() within src/tools/BashTool/bashPermissions.ts, where the sandbox auto-allow feature returns an allow decision immediately when no explicit deny rule is configured, bypassing the critical checkPathConstraints() validation step that filters path traversal attempts. The logic flaw occurs at approximately line 1445, where the function returns early without executing the path constraint filter at line 1644. An attacker operating in a sandboxed session with auto-allow enabled and no explicit deny rules can submit bash commands containing path traversal sequences to read or write arbitrary files subject to OS-level permissions. The vulnerability affects all versions prior to 0.5.1 and requires local access, low privileges, and no user interaction to exploit. Recommended fixes include continuing the permission pipeline to always evaluate path constraints or reordering the function to execute path validation before the sandbox auto-allow block.

Affected products

  • Gitlawb OpenClaude before 0.5.1

Identifiers

  • CVE-2026-35570
  • GHSA-m6rx-7pvw-2f73

Timeline

  • 2026-04-21: disclosed
  • 2026-04-21: patched: Fixed in version 0.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.