Openclaw cli: OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows (CVE-2026-22180)

CVE-2026-22180 is a vulnerability in the openclaw-cli npm package where a path-confinement bypass in browser output handling permitted writes outside the intended root directories. The affected versions are all releases up to and including 2026.3.1. The fix, introduced in version 2026.3.2, implements a unified root-bound, file-descriptor-verified commit flow for browser output writes and canonical in-base validation for install and skills paths to prevent path escapes. Additional regression coverage was added to ensure symlink-rebind and root-bound source-path write behaviors are correctly enforced.

The vulnerability allows an attacker with local privileges to write files outside the intended root directories, potentially leading to unauthorized file modifications or system integrity issues. The CVSS score is 5.3 (medium severity), indicating limited but notable confidentiality, integrity, and availability impacts. There are no known exploits in the wild.

A patch is available in openclaw-cli version 2026.3.2. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation actions are indicated by the vendor advisory.