Skip to content
Fencer Intel
high —

GHSA-3jx4-q2m7-r496 json

OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations

published 8mo ago modified 8mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary In certain workspace-restricted configurations, OpenClaw could follow hardlink aliases inside the workspace that reference files outside the workspace boundary.

By default, `tools.fs.workspaceOnly` is off. This primarily affects deployments that intentionally enable workspace-only filesystem restrictions (and workspace-only `apply_patch` checks).

### Impact - Confidentiality: out-of-workspace files could be read through in-workspace hardlink aliases. - Integrity: out-of-workspace files could be modified through in-workspace hardlink aliases.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version at triage time: `2026.2.24` - Affected range: `<= 2026.2.24` - Planned patched version: `2026.2.25`

### Fix Commit(s) - `04d91d0319b82fd4de91ed05e9fc5219ff2ab64e` (main)

### Remediation OpenClaw now rejects hardlinked final-file aliases during workspace boundary validation for: - workspace-only path checks (`read` / `write` / `edit`) - workspace-only `apply_patch` read/write paths - sandbox mount-root path-safety checks

Regression tests were added for `apply_patch`, workspace fs tools, and sandbox fs bridge hardlink alias escapes.

OpenClaw thanks @tdjackey for reporting.

Patch / fix

  • npm openclaw 2026.2.25

Is GHSA-3jx4-q2m7-r496 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm openclaw
<2026.2.25
2026.2.25

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of openclaw/openclaw published their own advisory on GitHub. Reviewed sources take precedence over it.