Mar 3, 2026·5 min read·23 visits
OpenClaw prior to v2026.2.14 contains a Zip Slip vulnerability in its skill installation logic. Attackers can craft malicious archives with directory traversal sequences (e.g., `../../`) to overwrite critical system files when the archive is extracted. This can result in arbitrary code execution or system compromise.
A critical Zip Slip vulnerability exists in OpenClaw versions prior to 2026.2.14. The application's archive extraction mechanism failed to properly validate entry paths within ZIP and TAR archives, allowing malicious actors to write arbitrary files to the filesystem outside the intended destination directory. This flaw affects the skill installation process and internal asset management, potentially leading to Remote Code Execution (RCE) via configuration or executable overwrite.
OpenClaw is an open-source personal AI assistant that supports modular extensions through skills, plugins, and internal tools. A security assessment revealed a critical Arbitrary File Write vulnerability, commonly known as 'Zip Slip', within the application's archive extraction routines. This mechanism is primarily used when the application downloads and installs external assets, such as community skills or tools like signal-cli.
The vulnerability arises because the extraction logic blindly trusts the file paths specified within archive entries. When OpenClaw unpacks a compressed file (ZIP or TAR), it constructs the destination path by concatenating the target directory with the entry's name. If an attacker crafts an archive entry with a name like ../../../../root/.ssh/authorized_keys, the application writes the file content to that resolved path, bypassing the intended sandbox directory.
Simultaneously, related path traversal issues were identified in the Browser Tool component. The /hooks/file-chooser endpoint lacked path confinement for uploads, and the download manager accepted suggested filenames containing traversal sequences, further expanding the attack surface for local file system manipulation.
The root cause of this vulnerability is the absence of canonical path validation during the file extraction process. This falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
In a secure extraction implementation, the application must perform the following steps for every entry in an archive:
. and ..).OpenClaw failed to implement step 4. Specifically, the extraction logic utilized unzip (or JS equivalents) and tar commands without flags or logic to strip directory components or validate the final destination. Consequently, the filesystem APIs treated the traversal sequences as valid instructions to navigate up the directory tree, allowing files to escape the targetDir confinement.
The vulnerability was remediated in version 2026.2.14 by introducing a centralized, secure extraction utility in infra/archive.ts. The patch replaces the insecure extraction calls with a validation routine that strictly enforces path confinement.
The following code snippet demonstrates the logic used to validate archive entries before writing them to disk. It normalizes paths and explicitly checks for traversal attempts:
// src/infra/archive.ts (Patched Logic)
function validateArchiveEntryPath(entryPath: string, targetDir: string): void {
// 1. Normalize separators to forward slashes
// 2. Normalize relative segments (collapsing '..')
const normalized = path.posix.normalize(entryPath.replaceAll("\\", "/"));
// Check 1: Prevent immediate traversal indicators
if (normalized === ".." || normalized.startsWith("../")) {
throw new Error(`Security Violation: Archive entry escapes destination: ${entryPath}`);
}
// Check 2: Prevent absolute paths
if (path.posix.isAbsolute(normalized)) {
throw new Error(`Security Violation: Archive entry is absolute: ${entryPath}`);
}
// Check 3: Symlink and Hardlink restriction (Pseudo-code for logic)
// The patch also rejects entries identified as symlinks or hardlinks
// to prevent 'Symlink Slip' attacks.
}Additionally, the patch enforces strict directory confinement for other file operations. Downloads are now locked to /tmp/openclaw/downloads, and uploads are restricted to /tmp/openclaw/uploads, ensuring that temporary file operations cannot impact the host OS configuration.
To exploit this vulnerability, an attacker must induce the OpenClaw application to extract a malicious archive. This is typically achieved by distributing a compromised 'skill' or plugin via a community repository or by manipulating a download URL if the attacker has a Man-in-the-Middle (MitM) position or control over an update server.
Attack Scenario:
../../../../../../bin/malicious_script.sh.openclaw skills install <malicious-skill>.malicious_script.sh to the system's /bin directory, overwriting any existing file or creating a new one.Due to the permissions typically required by OpenClaw to manage system tools, the overwritten files often execute with high privileges, leading to immediate system compromise.
The impact of this vulnerability is rated as High. The ability to write arbitrary files to the filesystem provides attackers with multiple avenues to achieve Remote Code Execution (RCE).
~/.ssh/authorized_keys allows direct SSH access..bashrc ensures code execution upon user login.The vulnerability is particularly dangerous in environments where OpenClaw runs with elevated privileges or in containerized environments where the container filesystem is not read-only.
| Product | Affected Versions | Fixed Version |
|---|---|---|
openclaw OpenClaw | < 2026.2.14 | 2026.2.14 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-22 |
| Attack Vector | Network / Local (User Interaction) |
| Impact | Arbitrary File Write / RCE |
| Severity | High |
| Exploit Status | PoC Available |
| Platform | Node.js |
An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.
A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.
OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.
An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.
A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.
An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.