CVE-2026-28457: OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace
(updated )
- Files may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw).
References
- github.com/advisories/GHSA-xw4p-pw82-hqr7
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/3eb6a31b6fcf8268456988bfa8e3637d373438c2
- github.com/openclaw/openclaw/security/advisories/GHSA-xw4p-pw82-hqr7
- nvd.nist.gov/vuln/detail/CVE-2026-28457
- www.vulncheck.com/advisories/openclaw-path-traversal-in-sandbox-skill-mirroring-via-name-parameter
Code Behaviors & Features
Detect and mitigate CVE-2026-28457 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →