Openclaw cli: OpenClaw hook transform path containment missed symlink-resolved escapes

OpenClaw CLI's webhook transform modules perform only lexical path validation, which can be bypassed by symlinks that resolve outside the trusted transform directory. This allows an attacker who can influence transform path resolution and place symlinks to attacker-controlled code to cause the gateway to dynamically import and execute unintended JavaScript code with elevated privileges. The vulnerability affects openclaw versions <= 2026.2.21-2. The planned fix in version 2026.2.22 enforces realpath-aware containment checks before dynamic import, while retaining lexical checks for traversal and absolute path escapes. Additional regression tests will cover symlink escape rejection and allowed in-root symlink cases.

If exploited, an attacker could cause the gateway to import and execute arbitrary JavaScript code with gateway-process privileges by leveraging symlink path escapes in webhook transform modules. This could lead to unauthorized code execution within the gateway process. Exploitation requires specific conditions including enabled hook transforms, attacker control over transform path resolution, and presence of symlink escapes to attacker-controlled code.

A patch is available and planned for release in version 2026.2.22 that enforces realpath-aware containment checks to prevent symlink escapes before dynamic import. Users should upgrade to this fixed version once released. Until then, ensure that hook transforms are not exposed to attacker-controlled paths or writable filesystem locations that could be used to create symlink escapes. The fix includes regression coverage for symlink escape rejection and allowed symlink cases within the root directory.