High severity7.3NVD Advisory· Published Apr 23, 2026· Updated May 12, 2026
CVE-2026-41355
CVE-2026-41355
Description
OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host during gateway startup by exploiting enabled workspace hooks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.3.28 | 2026.3.28 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1nvdPatchWEB
- github.com/advisories/GHSA-42mx-vp8m-j7qhghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-42mx-vp8m-j7qhnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41355ghsaADVISORY
- www.vulncheck.com/advisories/openshell-arbitrary-code-execution-via-mirror-mode-sandbox-file-conversionnvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.