Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-35658
6.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool
OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.
References
-
GitHub Security Advisory (GHSA-cfp9-w5v9-3q4h) third-party-advisory
-
Patch Commit #1 patch
-
Patch Commit #2 patch
-
Patch Commit #3 patch
-
Patch Commit #4 patch
-
VulnCheck Advisory: OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool third-party-advisory
Affected products
OpenClaw
- <2026.3.2
- ==2026.3.2
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@chrisportela Chris Portela <chris@chrisportela.com>