Executive brief
OpenClaw is a JavaScript library that provides filesystem access through the OpenShell bridge. A race condition vulnerability allows attackers to bypass sandbox restrictions and read files outside the intended directory by swapping symlinks during filesystem operations, potentially exposing sensitive data.
Technical details
This is a time-of-check/time-of-use (TOCTOU) race condition (CWE-367) in the OpenShell filesystem bridge. The vulnerable component fails to use no-follow semantics when opening files and does not validate the file descriptor against the canonical mount root before returning data. An attacker can exploit symlink swaps between the filesystem check and the actual file read to access files outside the sandbox boundary. The fix in version 2026.4.22 implements no-follow file opens, file descriptor validation against the mount root, rejection of unsafe hardlink/symlink cases, and strict ancestor walk validation on platforms without fd-path readback capabilities.
Affected products
- OpenClaw OpenClaw <= 2026.4.21
Timeline
- 2026-04-23: disclosed
- 2026-04-23: patched: Version 2026.4.22 released with fix