Executive brief
OpenClaw is a containerized sandboxing tool that restricts which files applications can write to. A race condition in the file write operation allows a containerized attacker to redirect approved file writes outside the validated sandbox directory, potentially accessing or modifying host files. This bypasses the sandbox security boundary that is meant to isolate application behavior.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition (CWE-367) in the fs-bridge writeFile commit step. The vulnerability exists in the final move operation, which uses an unanchored container path instead of verifying the target path is still within the validated writable directory. An attacker with local access and low privileges can win a race by modifying parent directory paths inside the sandbox between the safety revalidation check and the actual file move operation, causing files to land outside the intended sandbox path. The fix (version 2026.3.11) anchors the writeFile commit path to the canonical parent directory before performing the final move.
Affected products
- OpenClaw OpenClaw before 2026.3.11
Timeline
- 2026-03-12: disclosed
- 2026-03-11: patched: Version 2026.3.11 released with fix