Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-41355

OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host during gateway startup by exploiting enabled workspace hooks.

VectorLOCAL

PublishedApr 23, 2026, 22:16

Published Bydisclosure@vulncheck.com

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

openclaw(npm)02026.3.28N/A

References

https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1
https://github.com/openclaw/openclaw/security/advisories/GHSA-42mx-vp8m-j7qh
https://www.vulncheck.com/advisories/openshell-arbitrary-code-execution-via-mirror-mode-sandbox-file-conversion

Weakness Type

CWE-829

CVSS Metrics

Base Score

5.4

Vector String

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityMedium

Version

4.0

Attack Vector (AV)

LOCAL