https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 18:08:09 +0000 https://vulnerability.circl.lu/vuln/cve-2026-27670 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.</p> https://vulnerability.circl.lu/vuln/cve-2026-27670 https://vulnerability.circl.lu/vuln/ghsa-r54r-wmmq-mh84 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable versions: `&lt;= 2026.3.1` - Latest published vulnerable version confirmed: `2026.3.1` (npm as of 2026-03-02) - Patched version: `2026.3.2` (released)</p> <p>### Technical Details In `src/infra/archive.ts`, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root.</p> <p>The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in `src/infra/fs-safe.ts` and regression coverage in `src/infra/archive.test.ts`.</p> <p>### Fix Commit(s) - `7dac9b05dd9d38dd3929637f26fa356fd8bdd107`</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable versions: `&lt;= 2026.3.1` - Latest published vulnerable version confirmed: `2026.3.1` (npm as of 2026-03-02) - Patched version: `2026.3.2` (released)</p> <p>### Technical Details In `src/infra/archive.ts`, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root.</p> <p>The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in `src/infra/fs-safe.ts` and regression coverage in `src/infra/archive.test.ts`.</p> <p>### Fix Commit(s) - `7dac9b05dd9d38dd3929637f26fa356fd8bdd107`</p> https://vulnerability.circl.lu/vuln/ghsa-r54r-wmmq-mh84