Search: CVE-2026-44113

CVE-2026-44113 is a medium severity vulnerability in the openclaw npm package (openclaw-cli) affecting versions from 2026.1.29 up to but not including 2026.4.22. It involves a time-of-check/time-of-use (TOCTOU) race condition in the OpenShell sandbox filesystem reads, where a symlink swap could allow reading bytes outside the intended mount root. The issue is fixed in version 2026.4.22 by enforcing no-follow semantics on file opens, validating file descriptors against the canonical mount root, rejecting unsafe hardlink/symlink cases, and using strict ancestor walks on platforms lacking fd-path readback. The fix is publicly available and verified in the npm package.