GHSA-3pxq-f3cp-jmxp: OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows

March 3, 2026

A path-confinement bypass in browser output handling allowed writes outside intended roots in openclaw versions up to and including 2026.3.1.

The fix unifies root-bound, file-descriptor-verified write semantics and canonical path-boundary validation across browser output and related install/skills write paths.

References

github.com/advisories/GHSA-3pxq-f3cp-jmxp
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/104d32bb64cdf19d5e77f70553a511a2ae90ad1c
github.com/openclaw/openclaw/security/advisories/GHSA-3pxq-f3cp-jmxp

Code Behaviors & Features

Detect and mitigate GHSA-3pxq-f3cp-jmxp with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →