Threats tagged 'ghsa-42mx-vp8m-j7qh'

OpenShell's `mirror` mode in the openclaw npm package can convert untrusted sandbox files into explicitly enabled workspace hooks, which are then executed on the host during gateway startup. This vulnerability affects versions up to 2026.3.24 and is fixed starting from version 2026.3.28. Exploitation requires mirror mode enabled, hooks enabled, explicit hook opt-in, and a restart, making exploitation conditions narrow.