GHSA-659f-22xc-98f2: OpenClaw hook transform path containment missed symlink-resolved escapes

March 3, 2026

When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges.

References

github.com/advisories/GHSA-659f-22xc-98f2
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/f4dd0577b055f77af783105bd65eae32f3d5e6a1
github.com/openclaw/openclaw/security/advisories/GHSA-659f-22xc-98f2

Code Behaviors & Features

Detect and mitigate GHSA-659f-22xc-98f2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →