CVE-2026-27485
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill contents. This issue has been fixed in version 2026.2.18.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill contents. This issue has been fixed in version 2026.2.18.
- Record
CVE-2026-27485- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-61
- Updated
- 2026-11-02
EUVDEUVD-2026-7714
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill contents. This issue has been fixed in version 2026.2.18.
- Record
EUVD-2026-7714- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r6h2-5gqq-v5v6
OpenClaw: Reject symlinks in local skill packaging script
Vulnerability
skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives.
If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents.
Severity and Exposure
- Severity: Low
- Execution context: local/manual workflow only (skill author packaging step)
- No remote trigger: this is not reachable via normal OpenClaw gateway/chat runtime paths
- No extraction Zip Slip in this finding: this issue is limited to packaging-time symlink following
Impact
- Potential unintentional disclosure of local files from the packaging machine into a generated
.skillartifact. - Requires local execution of the packaging script on attacker-controlled skill contents.
Affected Components
skills/skill-creator/scripts/package_skill.py
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published version during triage:
2026.2.17 - Vulnerable version range:
<= 2026.2.17 - Planned patched version (next release):
2026.2.18
Remediation
- Reject symlinks during skill packaging.
- Add regression tests for symlink file and symlink directory cases.
- Update packaging guidance to document the symlink restriction.
Fix Commit(s)
c275932aa4230fb7a8212fe1b9d2a18424874b3fee1d6427b544ccadd73e02b1630ea5c29ba9a9f0
Related PR
Release Process Note
patched_versions is pre-set to the planned next release (2026.2.18). Once npm openclaw@2026.2.18 is published, this advisory is ready to publish without additional edits.
Thanks @aether-ai-agent for reporting.
- Record
GHSA-r6h2-5gqq-v5v6- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-61
- Updated
- 2026-11-02
NVD
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill contents. This issue has been fixed in version 2026.2.18.
- Record
CVE-2026-27485- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
OSV
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill contents. This issue has been fixed in version 2026.2.18.
- Record
CVE-2026-27485- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-61
- Updated
- 2026-11-02
OSVGHSA-r6h2-5gqq-v5v6
OpenClaw: Reject symlinks in local skill packaging script
Vulnerability
skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives.
If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents.
Severity and Exposure
- Severity: Low
- Execution context: local/manual workflow only (skill author packaging step)
- No remote trigger: this is not reachable via normal OpenClaw gateway/chat runtime paths
- No extraction Zip Slip in this finding: this issue is limited to packaging-time symlink following
Impact
- Potential unintentional disclosure of local files from the packaging machine into a generated
.skillartifact. - Requires local execution of the packaging script on attacker-controlled skill contents.
Affected Components
skills/skill-creator/scripts/package_skill.py
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published version during triage:
2026.2.17 - Vulnerable version range:
<= 2026.2.17 - Planned patched version (next release):
2026.2.18
Remediation
- Reject symlinks during skill packaging.
- Add regression tests for symlink file and symlink directory cases.
- Update packaging guidance to document the symlink restriction.
Fix Commit(s)
c275932aa4230fb7a8212fe1b9d2a18424874b3fee1d6427b544ccadd73e02b1630ea5c29ba9a9f0
Related PR
Release Process Note
patched_versions is pre-set to the planned next release (2026.2.18). Once npm openclaw@2026.2.18 is published, this advisory is ready to publish without additional edits.
Thanks @aether-ai-agent for reporting.
- Record
GHSA-r6h2-5gqq-v5v6- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-61
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-27485 is a medium vulnerability (CVSS 4.6) in Openclaw, published February 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in openclaw 2026.2.19.
References
github.com/openclaw/openclaw/security/advisories/GHSA-r6h2-5gqq-v5v6
nvd.nist.gov/vuln/detail/CVE-2026-27485