Openclaw cli: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes (CVE-2026-44113)

The vulnerability CVE-2026-44113 in openclaw-cli versions >=2026.1.29 <2026.4.22 is a TOCTOU race condition in the OpenShell FS bridge. This flaw allows an attacker to exploit a symlink swap during filesystem reads to access bytes outside the intended sandbox mount root. The fix implemented in version 2026.4.22 includes opening files with no-follow semantics where supported, validating the pinned file descriptor against the canonical mount root, rejecting unsafe hardlink and symlink cases, and applying a strict fallback ancestor walk on platforms without file descriptor path readback capabilities. The patch is confirmed in the public v2026.4.22 release and the npm package.

An attacker exploiting this vulnerability could cause the OpenShell sandbox filesystem reads to return data outside the intended mount root by performing a symlink swap during the time-of-check/time-of-use window. This could lead to unauthorized disclosure of filesystem data. The CVSS v3.1 score is 5.3 (medium), reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

A fix is available in openclaw version 2026.4.22. Users should upgrade to this version or later to remediate the vulnerability. The fix enforces no-follow semantics on file opens, validates file descriptors against the mount root, rejects unsafe symlink/hardlink cases, and applies strict fallback checks. No additional mitigation is required beyond applying the official patch.