GHSA-6c4r-g249-wv3c: OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts
OpenClaw versions prior to 2026.4.26 contain a vulnerability where spawning a child session from a sandboxed parent session could expose the real host workspace path to the child session prompt. This exposure may reveal sensitive workspace location or related memory context depending on the operator's configuration and trust boundaries. The issue does not affect the overall trusted-operator model but is scoped to the sandboxed session spawn feature. The vulnerability has moderate impact and no known exploits in the wild. Mitigation includes avoiding spawning child sessions from sensitive sandboxed workspaces until patched and applying configuration hardening such as narrow allowlists and disabling the feature if not needed.
AI Analysis
Technical Summary
In OpenClaw versions before 2026.4.26, a sandboxed session spawn feature could leak the real host workspace path to child session prompts. This occurs when a child session is spawned from a sandboxed parent, forwarding the host workspace path into the child prompt. The vulnerability is scoped to this feature and does not alter the trusted-operator security model. The practical impact depends on the operator's configuration and whether untrusted input can reach the exposed path. The first stable patched version addressing this issue is 2026.4.26.
Potential Impact
The vulnerability may disclose the host workspace location or related memory context to child sessions spawned from sandboxed parents. This could potentially expose sensitive environment details depending on the deployment and trust configuration. There are no known exploits in the wild, and the impact is considered moderate.
Mitigation Recommendations
A fix is available in OpenClaw version 2026.4.26. Until upgrading, avoid spawning child sessions from sensitive sandboxed workspaces. Additionally, restrict channel and tool allowlists, avoid sharing a single Gateway instance between mutually untrusted users, and disable the sandboxed session spawn feature when not required.
GHSA-6c4r-g249-wv3c: OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts
Description
OpenClaw versions prior to 2026.4.26 contain a vulnerability where spawning a child session from a sandboxed parent session could expose the real host workspace path to the child session prompt. This exposure may reveal sensitive workspace location or related memory context depending on the operator's configuration and trust boundaries. The issue does not affect the overall trusted-operator model but is scoped to the sandboxed session spawn feature. The vulnerability has moderate impact and no known exploits in the wild. Mitigation includes avoiding spawning child sessions from sensitive sandboxed workspaces until patched and applying configuration hardening such as narrow allowlists and disabling the feature if not needed.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In OpenClaw versions before 2026.4.26, a sandboxed session spawn feature could leak the real host workspace path to child session prompts. This occurs when a child session is spawned from a sandboxed parent, forwarding the host workspace path into the child prompt. The vulnerability is scoped to this feature and does not alter the trusted-operator security model. The practical impact depends on the operator's configuration and whether untrusted input can reach the exposed path. The first stable patched version addressing this issue is 2026.4.26.
Potential Impact
The vulnerability may disclose the host workspace location or related memory context to child sessions spawned from sandboxed parents. This could potentially expose sensitive environment details depending on the deployment and trust configuration. There are no known exploits in the wild, and the impact is considered moderate.
Mitigation Recommendations
A fix is available in OpenClaw version 2026.4.26. Until upgrading, avoid spawning child sessions from sensitive sandboxed workspaces. Additionally, restrict channel and tool allowlists, avoid sharing a single Gateway instance between mutually untrusted users, and disable the sandboxed session spawn feature when not required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6c4r-g249-wv3c
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a46ecc627e9c7971943d989
Added to database: 07/02/2026, 22:57:10 UTC
Last enriched: 07/02/2026, 23:19:34 UTC
Last updated: 07/02/2026, 23:19:34 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.