CVE-2026-100542

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CVE-2026-100542

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

EUVD-2026-87508

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CVE-2026-100542

The OpenClaw (npm package 'openclaw' ) versions >= 2026.5.28 and

PT-2026-99179

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.28 through 2026.8.0 Description The tar.bz2 skill installer mishandles archive listings by treating bounded command-output suffixes as complete listings. A specially crafted .tar.bz2 or .tbz2 skill archive can push...