https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T11:38:46.902777+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41338 BREW-openclaw-cli-CVE-2026-41338 — OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses 2026-10-05T11:38:46.973613+00:00

Affected: Homebrew: openclaw-cli

## Summary Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Released workspace-only apply_patch remove and mkdir operations were still check-then-act, but the draft overstates scope by bundling broader edit paths; keep it open but narrow it to the actual sandbox-workspace mutation boundary.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `32a4a47d602e0618f87b3e59f94d8c142767f860` — 2026-03-30T16:49:49+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-292951 EUVD-2026-292951 2026-10-05T11:38:46.973678+00:00 EUVD-2026-292951 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41338 fkie_cve-2026-41338 2026-10-05T11:38:46.973696+00:00

OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Attackers can exploit check-then-act patterns in apply_patch, remove, and mkdir operations to manipulate files between validation and execution.

 https://cve.radiocsirt.org/vuln/ghsa-9hhx-mwf2-vr7v GHSA-9hhx-mwf2-vr7v 2026-10-05T11:38:46.973720+00:00

OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Attackers can exploit check-then-act patterns in apply_patch, remove, and mkdir operations to manipulate files between validation and execution.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-05T11:38:46.973736+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.