https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:46:57.249556+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-43567 BREW-openclaw-cli-CVE-2026-43567 — OpenClaw: screen_record outPath bypassed workspace-only filesystem guard 2026-10-04T20:46:57.252727+00:00

Affected: Homebrew: openclaw-cli

## Summary

screen_record outPath bypassed workspace-only filesystem guard.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The node-host screen recording tool could honor an `outPath` outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.

## Technical Details

The fix applies the workspace-root guard to node tool `outPath` handling, including screen recording paths.

## Fix

The issue was fixed in #63551. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `635bb35b68d8faa5bfa2fda35feadd315122748a` - PR: #63551

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @anshumanbh for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308559 EUVD-2026-308559 2026-10-04T20:46:57.252790+00:00 EUVD-2026-308559 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43567 fkie_cve-2026-43567 2026-10-04T20:46:57.252807+00:00

OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.

 https://cve.radiocsirt.org/vuln/ghsa-jf25-7968-h2h5 GHSA-jf25-7968-h2h5 — OpenClaw: screen_record outPath bypassed workspace-only filesystem guard 2026-10-04T20:46:57.252831+00:00

Affected: npm: openclaw

## Summary

screen_record outPath bypassed workspace-only filesystem guard.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The node-host screen recording tool could honor an `outPath` outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.

## Technical Details

The fix applies the workspace-root guard to node tool `outPath` handling, including screen recording paths.

## Fix

The issue was fixed in #63551. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `635bb35b68d8faa5bfa2fda35feadd315122748a` - PR: #63551

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @anshumanbh for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-04T20:46:57.252865+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.