https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:24:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-35632 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.</p> https://vulnerability.circl.lu/vuln/cve-2026-35632 https://vulnerability.circl.lu/vuln/ghsa-7xr2-q9vf-x4r5 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>The patch for CVE-2026-32013 introduced symlink resolution and workspace boundary enforcement for `agents.files.get` and `agents.files.set`. However, two other handlers in the same file (`agents.create` and `agents.update`) still use raw `fs.appendFile` on the `IDENTITY.md` file **without any symlink containment check**. An attacker who can place a symlink in the agent workspace can hijack the `IDENTITY.md` path to append attacker-controlled content to arbitrary files on the system.</p> <p>### Details</p> <p>In `src/gateway/server-methods/agents.ts`, the `agents.create` handler constructs the identity path and appends agent metadata without verifying symlinks:</p> <p>```typescript // agents.create — line 283-291 const identityPath = path.join(workspaceDir, DEFAULT_IDENTITY_FILENAME); const lines = [ &#34;&#34;, `- Name: ${safeName}`, ...(emoji ? [`- Emoji: ${sanitizeIdentityLine(emoji)}`] : []), ...(avatar ? [`- Avatar: ${sanitizeIdentityLine(avatar)}`] : []), &#34;&#34;, ]; await fs.appendFile(identityPath, lines.join(&#34;\n&#34;), &#34;utf-8&#34;); // ← NO SYMLINK CHECK ```</p> <p>The `agents.update` handler has the same issue at line 348-349:</p> <p>```typescript // agents.update — line 348-349 const identityPath = path.join(workspace, DEFAULT_IDENTITY_FILENAME); await fs.appendFile(identityPath, `\n- Avatar: ${sanitizeIdentityLine(avatar)}\n`, &#34;utf-8&#34;); // ← NO SYMLINK CHECK ```</p> <p>`fs.appendFile` follows symlinks by default. If the `IDENTITY.md` file in the workspace is a symlink pointing to a sensitive file…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>The patch for CVE-2026-32013 introduced symlink resolution and workspace boundary enforcement for `agents.files.get` and `agents.files.set`. However, two other handlers in the same file (`agents.create` and `agents.update`) still use raw `fs.appendFile` on the `IDENTITY.md` file **without any symlink containment check**. An attacker who can place a symlink in the agent workspace can hijack the `IDENTITY.md` path to append attacker-controlled content to arbitrary files on the system.</p> <p>### Details</p> <p>In `src/gateway/server-methods/agents.ts`, the `agents.create` handler constructs the identity path and appends agent metadata without verifying symlinks:</p> <p>```typescript // agents.create — line 283-291 const identityPath = path.join(workspaceDir, DEFAULT_IDENTITY_FILENAME); const lines = [ &#34;&#34;, `- Name: ${safeName}`, ...(emoji ? [`- Emoji: ${sanitizeIdentityLine(emoji)}`] : []), ...(avatar ? [`- Avatar: ${sanitizeIdentityLine(avatar)}`] : []), &#34;&#34;, ]; await fs.appendFile(identityPath, lines.join(&#34;\n&#34;), &#34;utf-8&#34;); // ← NO SYMLINK CHECK ```</p> <p>The `agents.update` handler has the same issue at line 348-349:</p> <p>```typescript // agents.update — line 348-349 const identityPath = path.join(workspace, DEFAULT_IDENTITY_FILENAME); await fs.appendFile(identityPath, `\n- Avatar: ${sanitizeIdentityLine(avatar)}\n`, &#34;utf-8&#34;); // ← NO SYMLINK CHECK ```</p> <p>`fs.appendFile` follows symlinks by default. If the `IDENTITY.md` file in the workspace is a symlink pointing to a sensitive file…</p> https://vulnerability.circl.lu/vuln/ghsa-7xr2-q9vf-x4r5