CVE-2026-19008
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1 in the assertNoSymlinkEscape function of src/agents/sandbox-paths.ts, in the apply_patch Tool component. The issue is link following. The attack can be launched remotely. The exploit is public. The project was informed but has not responded.
Risk Assessment
A remote attacker can exploit symbolic links to access files outside the allowed area, potentially leading to confidentiality or integrity breaches.
Recommendation
Update openclaw-cn if a patch is available. If not, restrict access to the application and monitor file-related activities.
Other vulnerabilities in openclaw-cn
See all- CVE-2026-19007Medium
A vulnerability in mf-yang openclaw-cn up to 0.2.1 affects the function isApprovedElevatedSender in src/auto-reply/reply/reply-elevated.ts, causing improper privilege management. Remote exploitation is possible and the exploit is public.
- CVE-2026-19006Medium
A vulnerability in mf-yang openclaw-cn 2026.2.5 affects an unknown part of src/agents/bash-tools.exec.ts in the Ggateway Exec Approval Flow, leading to incorrect authorization. Remote attack is possible and exploit is public.
- CVE-2026-17458Medium
A vulnerability in openclaw-cn up to version 0.2.1 allows Server-Side Request Forgery (SSRF) via the clickViaPlaywright function in agent.act.ts. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-17457Medium
A vulnerability in openclaw-cn up to version 0.2.1 allows information disclosure via the assertBrowserNavigationAllowed function in navigation-guard.ts. Manipulation of the url argument leads to data leakage. The attack can be performed remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.