CVE-2026-27646
CVE-2026-27646 · OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-command to cross from sandboxed chat context into host-side ACP session initialization when ACP is enabled.
CVSS 5.8 · Media · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node