Executive brief
OpenClaw is a JavaScript-based API gateway that supports webhook transformations. The vulnerability allows attackers with filesystem or configuration access to bypass path containment checks through symlinks, enabling arbitrary code execution with gateway privileges. This could compromise the entire gateway and any data it processes.
Technical details
The vulnerability is a path traversal / code injection flaw (CWE-94) in OpenClaw's webhook transform module loading. Hook transform modules were validated using only lexical path checks, which do not follow symlinks; an attacker can create a symlink under the allowed hooks transform directory that resolves to attacker-controlled code outside the intended sandbox. When the gateway dynamically imports the transform module, the symlink is followed, leading to arbitrary JavaScript execution with gateway process privileges. Exploitation requires either privileged configuration access or write access to the filesystem paths where transforms are stored. A patch enforces realpath-aware containment by resolving path ancestors before import.
Affected products
- OpenClaw openclaw <= 2026.2.21-2
Timeline
- 2026-03-03: disclosed: GHSA advisory published
- 2026-02-22: patched: Fix commit merged; patch available in version 2026.2.22