Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-35658
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool
OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.
References
-
GitHub Security Advisory (GHSA-cfp9-w5v9-3q4h) third-party-advisory
-
Patch Commit #1 patch
-
Patch Commit #2 patch
-
Patch Commit #3 patch
-
Patch Commit #4 patch
-
VulnCheck Advisory: OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool third-party-advisory
Affected products
OpenClaw
- ==2026.3.2
- <2026.3.2
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@chrisportela Chris Portela <chris@chrisportela.com>