GHSA-x82f-27x3-q89c: OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries

March 2, 2026

A symlink-retarget TOCTOU race in writeFileWithinRoot could point an attacker-controlled path alias outside the configured root between resolution and write operations.

References

github.com/advisories/GHSA-x82f-27x3-q89c
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-x82f-27x3-q89c

Code Behaviors & Features

Detect and mitigate GHSA-x82f-27x3-q89c with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →