Executive brief
OpenClaw's OpenShell is a filesystem bridge component used to safely sandbox file access within defined mount roots. A race condition in this bridge allows attackers to bypass sandbox restrictions through symlink swaps, potentially reading sensitive files from the host system outside the intended sandbox boundaries. This could expose confidential data or system files that should be restricted.
Technical details
The vulnerability is a time-of-check/time-of-use (TOCTOU) race condition (CWE-367) in the OpenShell sandbox filesystem read operations. An attacker can swap parent directory symlinks between the time the filesystem bridge validates a file path and the time it actually reads the file, causing the read to access a different file outside the allowed mount root. The fix uses no-follow file open semantics where available, validates pinned file descriptors against the canonical mount root, rejects unsafe hardlink and symlink cases, and implements strict ancestor chain validation on platforms without fd-path readback capabilities. The patch is available in version 2026.4.22 and has undergone focused regression testing.
Affected products
- OpenClaw openclaw <= 2026.4.21
Timeline
- 2026-05-04: disclosed: Advisory published
- 2026-04-22: patched: Fix commit merged for version 2026.4.22
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3g-6xhh-rg6p
- https://github.com/openclaw/openclaw/commit/95119017c847c737bd113f0bff728c4666d79c45
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-time-of-check-time-of-use-race-condition-in-openshell-fs-bridge