Search: CVE-2026-44112

Openclaw CLI versions up to 2026.4.21 contain a vulnerability where OpenShell filesystem bridge writes can be redirected outside the sandbox mount root due to a time-of-check/time-of-use (TOCTOU) race condition involving symlink swaps. This could allow unauthorized modification of files outside the intended sandbox. The issue is fixed in version 2026.4.22 by validating write paths against the mount root and rejecting unsafe symlinks.