Executive brief
OpenClaw's OpenShell component includes a "mirror mode" feature that synchronizes files between a sandbox environment and the host system. When workspace hooks are enabled, the mirror mode can inadvertently convert untrusted files from the sandbox into executable hook scripts on the host, allowing code execution during gateway startup. This vulnerability requires the attacker to have mirror mode access, hooks to be explicitly enabled, and the gateway to be restarted.
Technical details
This vulnerability arises from improper handling of the `hooks/` directory during mirror synchronization in OpenShell's sandbox backend. The `replaceDirectoryContents()` function lacked an exclusion filter for the `hooks/` directory, allowing malicious or compromised files from a mirrored sandbox to be copied into the host's trusted hook directories. Since workspace hooks are executed with host-level privileges during gateway startup, an attacker with access to the sandbox (mirror mode enabled) can craft malicious hook files that execute arbitrary code on the host. The attack requires three preconditions: mirror mode must be active, workspace hooks must be explicitly enabled, and the gateway must be restarted. The fix (v2026.3.28) excludes the `hooks/` directory from mirror synchronization entirely. Affected versions: <=2026.3.24; patched in >=2026.3.28.
Affected products
- OpenClaw OpenShell <= 2026.3.24
Timeline
- 2026-03-31: disclosed
- 2026-03-25: patched: Fix committed; released in v2026.3.28
- 2026-04-07: advisory: GHSA-42mx-vp8m-j7qh published
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-42mx-vp8m-j7qh
- https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openshell-arbitrary-code-execution-via-mirror-mode-sandbox-file-conversion