Three high-severity vulnerabilities in OpenClaw were disclosed, involving OS command injection with incomplete input filtering (GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm, CVSS 8.8 each) and a path traversal with bind mount bypass of directory denylist checks (GHSA-575v-8hfq-m3mc, CVSS 8.4). These flaws could allow attackers to execute arbitrary code on the host, escalate privileges, and steal credentials by bypassing sandbox restrictions. The path traversal vulnerability allows mounting parent directories like /home or /var, exposing sensitive files and Docker socket access. The vulnerabilities were exploited via AI agent workflows, including WhatsApp messages triggering host code execution. All issues are fixed in OpenClaw 2026.6.6. Operators are advised to restrict affected features, enable sandboxing, and narrow tool allowlists to reduce risk.

Successful exploitation could lead to arbitrary code execution on the host system, privilege escalation, and theft of sensitive credentials such as SSH keys, AWS credentials, and GPG secrets. The path traversal vulnerability enables sandbox escape by mounting sensitive directories, potentially exposing the Docker socket and allowing full host compromise. The vulnerabilities do not require prior foothold and can be triggered remotely via external messages (e.g., WhatsApp).

A fixed version of OpenClaw (2026.6.6) is available and should be applied promptly. Operators should enable sandbox mode for all non-main sessions, remove 'exec' from tool allowlists for channel-facing agents, and monitor for suspicious git clone commands using external protocol helpers. Before upgrading, restrict affected features to trusted operators or disable them if not needed. General hardening includes narrowing channel and tool allowlists and avoiding sharing gateways between untrusted users.