GHSA-7XR2-Q9VF-X4R5 OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Summary The patch for CVE-2026-32013 introduced symlink resolution and workspace boundary enforcement for agents.files.get and agents.files.set. However, two other handlers in the same file agents.create and agents.update still use raw fs.appendFile on the IDENTITY.md file without any symlink...

OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Summary The patch for CVE-2026-32013 introduced symlink resolution and workspace boundary enforcement for agents.files.get and agents.files.set. However, two other handlers in the same file agents.create and agents.update still use raw fs.appendFile on the IDENTITY.md file without any symlink...

CVE-2026-32013

creationtimestamp| type| source ---|---|--- 2026-03-19 23:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhh474zuly2s 2026-03-29 02:00:05+00:00| seen| https://t.me/GithubRedTeam/77718 2026-03-29 09:00:04+00:00| published-proof-of-concept|...