CVE-2026-41397 is a medium severity sandbox escape (CVSS 6.8) in OpenClaw. Before 2026.3.31, crafted symlinks in mirror sync operations can reach files outside the sandbox boundary. Upgrade the openclaw package to 2026.3.31 or later.
What's affected
Per the GitHub advisory for the npm package openclaw, versions up to 2026.3.28 are affected and 2026.3.31 or newer is patched. The maintainers' triage note says the 2026.3.28 release still had the boundary bug, because the earlier shipped change only excluded hooks and the full fix, a symlink free upload, came later.
How to check if you're exposed
npm ls openclaw
Check global installs and images. Then see whether you use the OpenShell mirror sync feature, and whether the synced directory can hold content from sources you do not control, since that is where a crafted symlink would come from.
What to do now
- Upgrade OpenClaw to 2026.3.31 or later.
- Until then, avoid mirror sync on directories that contain untrusted content.
- Search synced directories for symlinks that point outside their root and remove them.
- Run the tool with the narrowest file permissions you can.
Why it matters
The record lists CWE-59, improper link resolution before file access. A symlink is a file that points somewhere else. If a sync routine follows it without checking where it leads, content outside the intended boundary gets read or copied.
This class has been around for decades and keeps coming back in sandboxes and archive handlers. The rule is simple: resolve the real path and confirm it stays inside the root, or refuse links altogether. The record does not flag this CVE as known exploited.
Quick check
Why is the score only medium?
The vector marks attack complexity as high and requires low privileges. It still has high confidentiality and integrity impact, so patch it.
Sources
Last reviewed: 19 October 2026.
