GHSA-6r57-3vhv-2wpf: 
Python vulnerability analysis and mitigation

Impact

The local dashboard exposed GET /api/file and POST|PUT /api/file, which read and write files under the agent workspace. Two defects combined:

1. Workspace containment bypass (CWE-22). The containment check compared the resolved path with str.startswith() and no trailing separator. With a workspace of /home/u/.openclaw/workspace, a path of ../workspace_evil/secret.txt resolves to /home/u/.openclaw/workspace_evil/secret.txt, which passes a string-prefix test while sitting outside the workspace. Plain ../ traversal and absolute paths were correctly rejected; the bypass was specific to a sibling directory whose name begins with the workspace name.
2. Authentication trusted the socket peer only (CWE-346). Requests to /api/* skipped the gateway-token check whenever REMOTE_ADDR was a loopback address, without validating the Host header. A page on an attacker-controlled domain that rebinds its DNS to 127.0.0.1 therefore reached these endpoints: the peer is genuinely loopback, the browser treats the response as same-origin and can read it. Together, a victim who merely visited an attacker's page while the dashboard was running could have arbitrary files read from and written to, as the user running the dashboard. Reachable locations include ~/.ssh/, ~/.clawmetry/ (local store and cloud-sync keys), and shell profiles such as ~/.bashrc — making a write a path to code execution on the user's next shell. The write endpoint was reachable too. The existing cross-origin write guard compares Origin against Host; under DNS rebinding both are the attacker's domain, so they match and the guard permits the request. This was confirmed against the published 0.12.932 wheel.

Patches

Fixed in 0.12.933 (PyPI, 2026-10-25), released as part of vivekchand/clawmetry#6511:

• clawmetry/file_security.py::is_path_within() compares whole path components with os.path.commonpath() on resolved paths, and resolves the candidate as well as the root so a symlink inside the workspace cannot grant access outside it. All workspace memory, skill-file and transcript filesystem endpoints use it, including before cached reads.
• clawmetry/request_security.py::is_direct_loopback_request() requires a loopback peer and a loopback Host and the absence of X-Forwarded-For / X-Real-IP / Forwarded. The /api/* authentication hook calls it, so the exemption is no longer granted to a rebound or proxied request. Authenticated reverse proxies keep access via the gateway token.

Workarounds

Upgrade to 0.12.933 or later (pip install -U clawmetry). Installs with the default auto-update enabled have already taken the fix. There is no configuration-only mitigation for the containment bypass on an affected version.

Affected versions

All versions before 0.12.933. Confirmed vulnerable in 0.12.932 and confirmed fixed in 0.12.933, by replaying both vectors through the real application from each published wheel.

Severity

CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5, High). AV:N because of the DNS-rebinding path — the victim only has to visit a page. AC:H because the attacker must control a domain and hold the page open across the rebind. C:H/I:H/A:H because the two defects together yield arbitrary file read and arbitrary content-controlled file overwrite as the dashboard user.

Credit

Reported by Wu Jiaxuan (吴嘉炫), who found the containment bypass and the rebinding path and provided a precise proof of concept against the published wheel.