CVE-2026-27008
OpenClaw hardened the skill download target directory validation
Résumé
OpenClaw hardened the skill download target directory validation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in download skill installation allowed targetDir values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only skills.install flow, this could write files outside the intended install sandbox. Version 2026.2.15 contains a fix for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web github.com