OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)

보통 5.5CVE-2026-32044 · GHSA-77hf-7fqf-f227 · Published 21/03/2026 · updated 17/06/2026

요약

CVE-2026-32044은(는) openclaw (openclaw), openclaw에 영향을 주는 보통 (CVSS 5.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.14%, 전체 취약점의 3.1%보다 높음.
조치: 2026.3.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
openclaw openclaw	`< 2026.3.2`	`2026.3.2`
openclaw npm	`< 2026.3.2`	`2026.3.2`

Description

Summary

The tar.bz2 installer path in src/agents/skills-install-download.ts used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor.

This allowed crafted .tar.bz2 archives to bypass special-entry blocking and extracted-size guardrails enforced on other archive paths, causing local availability impact during skill install.

Affected Packages / Versions

Package: openclaw (npm)
Latest published at triage time: 2026.3.1
Affected range: <= 2026.3.1
Patched in: 2026.3.2 (released)

Impact

Local DoS / availability impact when processing untrusted .tar.bz2 skill archives.

Fix Commit(s)

0dbb92dd2bcf9a32379d11c0f11ed016669dae3e

Related advisories

Canonical overlap (closed): GHSA-3pj7-x8jr-jvj8
Duplicate variant (closed): GHSA-rgr7-g85h-6v82

NVD description

OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats. Attackers can craft malicious tar.bz2 skill archives to bypass special-entry blocking and extracted-size guardrails, causing local denial of service during skill installation.

References

openclaw/openclaw security advisory · WEB
openclaw/openclaw commit 0dbb92d · WEB
openclaw/openclaw · PACKAGE
vulncheck.com/advisories/openclaw-tar-archive-safety-bypass-in-skills-installation · Third Party Advisory

openclaw의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openclaw

< 2026.3.2

2026.3.2

openclaw

npm

< 2026.3.2

2026.3.2

Description

Summary

The tar.bz2 installer path in src/agents/skills-install-download.ts used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor.

This allowed crafted .tar.bz2 archives to bypass special-entry blocking and extracted-size guardrails enforced on other archive paths, causing local availability impact during skill install.

Affected Packages / Versions

Package: openclaw (npm)
Latest published at triage time: 2026.3.1
Affected range: <= 2026.3.1
Patched in: 2026.3.2 (released)

Impact

Local DoS / availability impact when processing untrusted .tar.bz2 skill archives.

Fix Commit(s)

0dbb92dd2bcf9a32379d11c0f11ed016669dae3e

Related advisories

Canonical overlap (closed): GHSA-3pj7-x8jr-jvj8
Duplicate variant (closed): GHSA-rgr7-g85h-6v82

NVD description

openclaw의 다른 취약점

모두 보기 →