Description
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openclaw | openclaw | < 2026.2.14 | 2026.2.14 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.2.14 | 2026.2.14 | GHSA-r5fq-947m-xm57 |
References
- GitHub Security Advisory (GHSA-r5fq-947m-xm57) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths third-party-advisory