Listen to this Post
The vulnerability arises from how openclaw handles exec routing for sandboxed agents. When an agent runs inside a sandbox, it normally restricts execution to local paths or predefined safe nodes. However, a flaw exists in versions prior to 2026.4.10 where an agent can manipulate the routing mechanism by setting the `host` parameter to the string "node". This override tricks the routing logic into treating the request as targeting a remote node instead of the local sandbox. The sandbox policy fails to validate that the `host` value is allowed for the current context. As a result, the agent can bypass the sandbox boundary and execute commands on an external node. This escape allows arbitrary code execution outside the intended isolation. The issue is rooted in improper input validation on the `host` field within the exec routing function. Specifically, the routing table does not differentiate between internal sandbox targets and external remote targets when `host=node` is provided. Attackers can exploit this by crafting a request that includes the override while still being considered a sandboxed operation. The sandbox’s execution path then redirects to a remote node, violating the security policy. The fix involves adding a check that blocks any sandboxed agent from setting `host` to `”node”` or any remote identifier. Instead, the routing remains locked to the active sandbox’s predefined execution context. The patch ensures that exec calls from sandboxed agents cannot escape to remote targets, preserving isolation.
Platform: npm
Version: 2026.4.5-2026.4.9
Vulnerability: Sandbox exec escape
Severity: Critical
date: 2026-04-17
Prediction: Patch already available (2026.4.10)
What Undercode Say:
Check installed openclaw version
npm list openclaw
Simulate vulnerable routing (conceptual)
curl -X POST http://sandbox/exec -d '{"host":"node","cmd":"whoami"}'
Verify fix by upgrading
npm install [email protected]
Exploit:
Sandboxed agent sends exec request with `host: “node”` override, causing routing to remote node, bypassing sandbox.
Protection from this CVE:
Upgrade to openclaw >=2026.4.10. Apply commit dffad08529202edbf34e4808788e1182fe10f6a9. Block `host=node` in input validation.
Impact:
Remote code execution outside sandbox; full compromise of host node; data leakage; lateral movement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
