CVE-2026-41355CWE-829

OpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversion

Medium · published April 23, 2026

CVSS v4.0
5.4
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host during gateway startup by exploiting enabled workspace hooks.

The record
Technical detail
CVSS v4.0
5.4 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00178 · 6.9th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-04-23T21:58Z
EPSS history
Timeline
  • 23 APR 21:58Z
    OpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversion
    cvelistv5