The vulnerability in Gitlawb's OpenClaude (CVE-2026-35570) arises from a logic flaw in the bashToolHasPermission() function within src/tools/BashTool/bashPermissions.ts. Specifically, when the sandbox auto-allow feature is active and no explicit deny rule exists, the function returns an allow decision before evaluating path constraints via checkPathConstraints. This premature allow enables commands containing path traversal sequences (e.g., ../../../../../etc/passwd) to bypass directory restrictions, potentially exposing sensitive files. The issue affects versions prior to 0.5.1, which includes the patch that corrects this logic flaw.

Exploitation of this vulnerability allows a local attacker with limited privileges to bypass directory restrictions and access sensitive files outside the intended sandbox. The CVSS score of 8.4 reflects high confidentiality and integrity impact, meaning attackers could read or modify restricted files. There is no impact on availability. No known exploits in the wild have been reported.

A patch fixing this vulnerability is included in OpenClaude version 0.5.1. Users should upgrade to version 0.5.1 or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the vendor's patch. Patch status is confirmed by the vendor's versioning and description. No additional mitigation steps are indicated by the vendor advisory.