要点
- CVE-2026-28457 は openclaw (openclaw), openclaw に影響する深刻度「高」 (CVSS 7.9) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.16%（全脆弱性の 5.1% より高い）。
- 対処：2026.2.14 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| openclaw | < 2026.2.14
| 2026.2.14
|
| openclaw npm | < 2026.2.14
| 2026.2.14
|
概要
Overview
In affected versions, OpenClaw’s sandbox skill mirroring used the skill’s frontmatter name as part of the destination path when copying skills into the sandbox workspace. A crafted skill name containing traversal segments (for example ../) or an absolute path could cause the copy to write outside <sandbox_workspace>/skills/.
Impact
- Files may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw).
Attack Requirements
- Attacker can provide a skill package (controls
SKILL.md frontmatter).
- Victim runs with sandbox enabled and skill mirroring into the sandbox workspace.
Affected Packages / Versions
openclaw (npm): < 2026.2.14
Fixed In
openclaw (npm): >= 2026.2.14
Fix Commit(s)
- 3eb6a31b6fcf8268456988bfa8e3637d373438c2
OpenClaw thanks @1seal for reporting.
NVD の説明
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name parameter unsanitized when copying skills into the sandbox workspace. Attackers who provide a crafted skill package with traversal sequences like ../ or absolute paths in the name field can write files outside the sandbox workspace root directory.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン