GHSA-fv94-qvg8-xqpw: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

April 2, 2026

SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

References

github.com/advisories/GHSA-fv94-qvg8-xqpw
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/3d5af14984ac1976c747a8e11581d697bd0829dc
github.com/openclaw/openclaw/releases/tag/v2026.3.31
github.com/openclaw/openclaw/security/advisories/GHSA-fv94-qvg8-xqpw

Code Behaviors & Features

Detect and mitigate GHSA-fv94-qvg8-xqpw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →