Advisory details:
github_osv / GHSA-r54r-wmmq-mh84
| Advisory ID | github_osv/GHSA-r54r-wmmq-mh84 |
| Aliases |
CVE-2026-28483
|
| Summary | OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind ### Summary ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write. ### Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable versions: `<= 2026.3.1` - Latest published vulnerable version confirmed: `2026.3.1` (npm as of 2026-03-02) - Patched version: `2026.3.2` (released) ### Technical Details In `src/infra/archive.ts`, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root. The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in `src/infra/fs-safe.ts` and regression coverage in `src/infra/archive.test.ts`. ### Fix Commit(s) - `7dac9b05dd9d38dd3929637f26fa356fd8bdd107` |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.8 |
| Risk | 3.9 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 8.7 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r54r-wmmq-mh84/GHSA-r54r-wmmq-mh84.json |
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/openclaw/openclaw | ||
| 7dac9b05dd9d38dd3929637f26fa356fd8bdd107 | Other | https://github.com/openclaw/openclaw/commit/7dac9b05dd9d38dd3929637f26fa356fd8bdd107 |
| GHSA-r54r-wmmq-mh84 | Advisory | https://github.com/openclaw/openclaw/security/advisories/GHSA-r54r-wmmq-mh84 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
There are no SSVC decisions available.