CVE-2026-39398: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39398 is a sandbox bypass vulnerability in the npm package openclaw-claude-bridge v1.1.0, where the use of --allowed-tools "" fails to restrict available CLI tools as documented. The CVE has been marked Rejected by the CVE program (noted as "affected product and advisory are not public"), but a GitHub Security Advisory (GHSA-7853-gqqm-vcwx) was published and reviewed on April 8, 2026. The affected version is openclaw-claude-bridge <= 1.1.1 (npm), with a patched version available at 2.0.0. The advisory is rated Moderate severity by GitHub (GitHub Advisory).

The root cause is an incorrect use of the Claude Code CLI flag --allowed-tools in place of --tools when spawning the Claude Code CLI subprocess (CWE-276: Incorrect Default Permissions; CWE-1188: Insecure Default Initialization of Resource). The --allowed-tools flag is an auto-approve allowlist — it controls which tools execute without permission prompts — not a restriction on which tools are available. The correct flag to disable all tools is --tools "". As a result, all CLI tools (Read, Write, Bash, WebFetch, etc.) remain nominally available to the subprocess, and the README's security claim that the sandbox disables all tools is false (GitHub Advisory).

Users deploying the bridge behind publicly exposed OpenClaw gateways, automated pipelines with web-fetched context, or agents consuming tool results from external systems may be relying on a sandbox that does not exist. If the underlying Claude Code CLI behavior changes in a future version to auto-allow tools in --print mode, prompt-injection attacks could trigger arbitrary Read, Write, and Bash operations within the gateway's process context. The false security claim in the README creates a compounded risk by giving downstream operators an unwarranted sense of safety (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The CVE itself has been rejected by the CVE program, limiting its visibility. The EPSS score is not published in available sources. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply untrusted prompts to a publicly exposed OpenClaw gateway or automated pipeline running the affected bridge version (GitHub Advisory).

1. Identify target: Locate a publicly exposed OpenClaw gateway or automated pipeline running openclaw-claude-bridge v1.1.0 that forwards untrusted user prompts to the Claude Code CLI subprocess.
2. Craft prompt injection payload: Construct a malicious prompt designed to instruct the Claude Code CLI to invoke a restricted tool (e.g., Bash, Write, or WebFetch) under the assumption that --allowed-tools "" has disabled all tools.
3. Submit payload: Send the crafted prompt through the exposed interface (e.g., HTTP request to the OpenClaw gateway, pipeline input, or agent tool result).
4. Trigger tool execution: Because --allowed-tools "" does not restrict tool availability, the subprocess may execute the requested tool operation (Read/Write/Bash/WebFetch) depending on undocumented CLI defaults in --print non-interactive mode.
5. Achieve objective: If tool execution proceeds, the attacker can read sensitive files, write arbitrary content, execute shell commands, or fetch external URLs within the gateway's process context (GitHub Advisory).

The vulnerability is fixed in openclaw-claude-bridge v2.0.0 (with an intermediate fix in v1.1.1, commit 8a296f5) by replacing --allowed-tools with --tools "" in the CLI subprocess invocation. The environment variable was also renamed from CLAUDE_ALLOWED_TOOLS to CLAUDE_TOOLS to match the corrected flag. As a workaround for v1.1.0, manually edit dist/cli-bridge.js to replace --allowed-tools with --tools; note that setting CLAUDE_ALLOWED_TOOLS on v1.1.0 has no mitigating effect (GitHub Advisory).

The vulnerability was discovered during a second-round code review and disclosed via GitHub Security Advisory. No notable public researcher commentary, vendor statements beyond the advisory, or significant media coverage has been identified for this CVE, consistent with its rejected CVE status and the niche scope of the affected package (GitHub Advisory).