The OpenClaw npm package prior to version 2026.7.1 suffers from a TOCTOU race condition in its OpenShell local mirror filesystem mutation operations. Specifically, the remove, mkdir, and rename functions perform a sandbox path-safety check but do not prevent the target path from being changed concurrently before the operation executes. This allows an attacker to cause these operations to affect host filesystem paths outside the sandbox, potentially deleting, creating, or renaming files with the privileges of the OpenClaw process user. This vulnerability does not require explicit host filesystem access permissions outside the sandbox. The vulnerability is addressed by updating to version 2026.7.1.

Successful exploitation allows an attacker with limited privileges to manipulate host filesystem paths outside the sandbox, potentially leading to high impact including confidentiality, integrity, and availability compromise of the host system files. The attacker can delete, create, or rename files outside the intended sandbox with the permissions of the OpenClaw process user. This could lead to privilege escalation or system compromise depending on the environment and user privileges.

Upgrade OpenClaw to version 2026.7.1 or later, where this TOCTOU race condition vulnerability is fixed. No other mitigation is required as the fix addresses the root cause.