Em resumo
- CVE-2026-27485 é uma vulnerabilidade MÉDIO (CVSS 4.4) que afeta openclaw (openclaw), openclaw.
- Chance de exploração nos próximos 30 dias (EPSS): 0.25%, maior que 16.3% das vulnerabilidades.
- Correção: atualize para 2026.2.19 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| openclaw | ≤ 2026.2.17
| No fix yet |
| openclaw npm | < 2026.2.19
| 2026.2.19
|
Description
Vulnerability
skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives.
If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents.
Severity and Exposure
- Severity: Low
- Execution context: local/manual workflow only (skill author packaging step)
- No remote trigger: this is not reachable via normal OpenClaw gateway/chat runtime paths
- No extraction Zip Slip in this finding: this issue is limited to packaging-time symlink following
Impact
- Potential unintentional disclosure of local files from the packaging machine into a generated
.skill artifact.
- Requires local execution of the packaging script on attacker-controlled skill contents.
Affected Components
skills/skill-creator/scripts/package_skill.py
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published version during triage:
2026.2.17
- Vulnerable version range:
<= 2026.2.17
- Planned patched version (next release):
2026.2.18
Remediation
- Reject symlinks during skill packaging.
- Add regression tests for symlink file and symlink directory cases.
- Update packaging guidance to document the symlink restriction.
Fix Commit(s)
c275932aa4230fb7a8212fe1b9d2a18424874b3fee1d6427b544ccadd73e02b1630ea5c29ba9a9f0
Related PR
Release Process Note
patched_versions is pre-set to the planned next release (2026.2.18). Once npm [email protected] is published, this advisory is ready to publish without additional edits.
Thanks @aether-ai-agent for reporting.
NVD description
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill contents. This issue has been fixed in version 2026.2.18.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free