CVE-2026-41338
CVE-2026-41338 · OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Attackers can exploit check-then-act patterns in apply_patch, remove, and mkdir operations to manipulate files between validation and execution.
CVSS 4.3 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-rm5c-4rmf-vvhw
- https://github.com/openclaw/openclaw/commit/32a4a47d602e0618f87b3e59f94d8c142767f860
- https://www.vulncheck.com/advisories/openclaw-time-of-check-time-of-use-toctou-vulnerability-in-sandbox-file-operations
- https://nvd.nist.gov/vuln/detail/CVE-2026-41338