CVE-2026-44113

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.

Summary

OpenShell FS bridge reads pin and verify the opened file before returning bytes

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.4.21
• Fixed version: 2026.4.22

Impact

A time-of-check/time-of-use race around OpenShell sandbox filesystem reads could let a symlink swap cause bytes outside the intended mount root to be read.

Fix

OpenShell reads now open the file with no-follow semantics where available, validate the pinned file descriptor against the canonical mount root, reject unsafe hardlink/symlink cases, and use a strict fallback ancestor walk on platforms without fd-path readback.

Fix Commit(s)

• 95119017c847c737bd113f0bff728c4666d79c45

Verification

• The fix commit is contained in the public v2026.4.22 tag.
• [email protected] is published on npm and the compiled package contains the fix.
• Focused regression coverage for this path passed before publication.

Thanks @VladimirEliTokarev for reporting.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5h3g-6xhh-rg6p. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.

Summary

OpenShell FS bridge reads pin and verify the opened file before returning bytes

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.4.21
• Fixed version: 2026.4.22

Impact

A time-of-check/time-of-use race around OpenShell sandbox filesystem reads could let a symlink swap cause bytes outside the intended mount root to be read.

Fix

OpenShell reads now open the file with no-follow semantics where available, validate the pinned file descriptor against the canonical mount root, reject unsafe hardlink/symlink cases, and use a strict fallback ancestor walk on platforms without fd-path readback.

Fix Commit(s)

• 95119017c847c737bd113f0bff728c4666d79c45

Verification

• The fix commit is contained in the public v2026.4.22 tag.
• [email protected] is published on npm and the compiled package contains the fix.
• Focused regression coverage for this path passed before publication.

Thanks @VladimirEliTokarev for reporting.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5h3g-6xhh-rg6p. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.