Mar 3, 2026·5 min read·18 visits
OpenClaw prior to v2026.2.14 contains a Zip Slip vulnerability in its skill installation logic. Attackers can craft malicious archives with directory traversal sequences (e.g., `../../`) to overwrite critical system files when the archive is extracted. This can result in arbitrary code execution or system compromise.
A critical Zip Slip vulnerability exists in OpenClaw versions prior to 2026.2.14. The application's archive extraction mechanism failed to properly validate entry paths within ZIP and TAR archives, allowing malicious actors to write arbitrary files to the filesystem outside the intended destination directory. This flaw affects the skill installation process and internal asset management, potentially leading to Remote Code Execution (RCE) via configuration or executable overwrite.
OpenClaw is an open-source personal AI assistant that supports modular extensions through skills, plugins, and internal tools. A security assessment revealed a critical Arbitrary File Write vulnerability, commonly known as 'Zip Slip', within the application's archive extraction routines. This mechanism is primarily used when the application downloads and installs external assets, such as community skills or tools like signal-cli.
The vulnerability arises because the extraction logic blindly trusts the file paths specified within archive entries. When OpenClaw unpacks a compressed file (ZIP or TAR), it constructs the destination path by concatenating the target directory with the entry's name. If an attacker crafts an archive entry with a name like ../../../../root/.ssh/authorized_keys, the application writes the file content to that resolved path, bypassing the intended sandbox directory.
Simultaneously, related path traversal issues were identified in the Browser Tool component. The /hooks/file-chooser endpoint lacked path confinement for uploads, and the download manager accepted suggested filenames containing traversal sequences, further expanding the attack surface for local file system manipulation.
The root cause of this vulnerability is the absence of canonical path validation during the file extraction process. This falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
In a secure extraction implementation, the application must perform the following steps for every entry in an archive:
. and ..).OpenClaw failed to implement step 4. Specifically, the extraction logic utilized unzip (or JS equivalents) and tar commands without flags or logic to strip directory components or validate the final destination. Consequently, the filesystem APIs treated the traversal sequences as valid instructions to navigate up the directory tree, allowing files to escape the targetDir confinement.
The vulnerability was remediated in version 2026.2.14 by introducing a centralized, secure extraction utility in infra/archive.ts. The patch replaces the insecure extraction calls with a validation routine that strictly enforces path confinement.
The following code snippet demonstrates the logic used to validate archive entries before writing them to disk. It normalizes paths and explicitly checks for traversal attempts:
// src/infra/archive.ts (Patched Logic)
function validateArchiveEntryPath(entryPath: string, targetDir: string): void {
// 1. Normalize separators to forward slashes
// 2. Normalize relative segments (collapsing '..')
const normalized = path.posix.normalize(entryPath.replaceAll("\\", "/"));
// Check 1: Prevent immediate traversal indicators
if (normalized === ".." || normalized.startsWith("../")) {
throw new Error(`Security Violation: Archive entry escapes destination: ${entryPath}`);
}
// Check 2: Prevent absolute paths
if (path.posix.isAbsolute(normalized)) {
throw new Error(`Security Violation: Archive entry is absolute: ${entryPath}`);
}
// Check 3: Symlink and Hardlink restriction (Pseudo-code for logic)
// The patch also rejects entries identified as symlinks or hardlinks
// to prevent 'Symlink Slip' attacks.
}Additionally, the patch enforces strict directory confinement for other file operations. Downloads are now locked to /tmp/openclaw/downloads, and uploads are restricted to /tmp/openclaw/uploads, ensuring that temporary file operations cannot impact the host OS configuration.
To exploit this vulnerability, an attacker must induce the OpenClaw application to extract a malicious archive. This is typically achieved by distributing a compromised 'skill' or plugin via a community repository or by manipulating a download URL if the attacker has a Man-in-the-Middle (MitM) position or control over an update server.
Attack Scenario:
../../../../../../bin/malicious_script.sh.openclaw skills install <malicious-skill>.malicious_script.sh to the system's /bin directory, overwriting any existing file or creating a new one.Due to the permissions typically required by OpenClaw to manage system tools, the overwritten files often execute with high privileges, leading to immediate system compromise.
The impact of this vulnerability is rated as High. The ability to write arbitrary files to the filesystem provides attackers with multiple avenues to achieve Remote Code Execution (RCE).
~/.ssh/authorized_keys allows direct SSH access..bashrc ensures code execution upon user login.The vulnerability is particularly dangerous in environments where OpenClaw runs with elevated privileges or in containerized environments where the container filesystem is not read-only.
| Product | Affected Versions | Fixed Version |
|---|---|---|
openclaw OpenClaw | < 2026.2.14 | 2026.2.14 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-22 |
| Attack Vector | Network / Local (User Interaction) |
| Impact | Arbitrary File Write / RCE |
| Severity | High |
| Exploit Status | PoC Available |
| Platform | Node.js |
An allocation of resources without limits or throttling vulnerability in the Elixir Mint HTTP client library allows malicious HTTP/2 servers to trigger memory exhaustion and application denial of service. The flaw exists because Mint fails to validate server-push concurrency limits during the receipt of PUSH_PROMISE frames, deferring validation to the HEADERS phase. This allows a server to reserve an unlimited number of streams in the client's memory map.
An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki prior to version 4.6.6. The application attempts to validate mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This design leads to both Regular Expression Denial of Service (ReDoS) and Remote Code Execution (RCE) via validation bypass.
An infinite loop vulnerability exists in the pure-Python PDF library pypdf prior to version 6.13.1. When parsing or merging a crafted PDF file containing a cyclic Article/Thread structure, the library fails to exit its traversal loop. This causes the executing thread to hang indefinitely, leading to 100% CPU utilization and a denial of service. The vulnerability is tracked under CVE-2026-54651 and GHSA-g9xf-7f8q-9mcj, with a CVSS base score of 5.5. This technical report provides a root cause analysis, code review, exploitation vectors, and mitigation paths.
The Netty-based HTTP Client in the Micronaut framework fails to enforce a maximum redirect ceiling by default when processing HTTP responses. This permits remote, attacker-controlled servers to trigger continuous, infinite redirect loops. The resulting recursion causes high CPU utilization, thread starvation, and potential memory exhaustion, inducing a Denial of Service (DoS) state in client-side applications.
An information disclosure vulnerability exists in the Micronaut Framework's HTTP client components. The client fails to clear sensitive authorization headers and cookies when following redirects across different origins. If an application using the vulnerable client communicates with an endpoint that issues a redirect to an external host, the client will forward the original credentials, leading to potential token theft and session hijacking.
GHSA-52vm-mxx8-f227 is a dual-vector security flaw in phantom-audio (<= 1.3.0). The vulnerability allows arbitrary file writes due to unconfined Model Context Protocol (MCP) tool paths when the PHANTOM_OUTPUT_DIR environment variable is not defined. Concurrently, the platform lacks validation controls during the decompression of highly compressed audio files, resulting in resource-exhaustion denial of service and downstream parsing vulnerability exposure.