Summary
OpenClaw: TOCTOU read in exec script preflight
OpenClaw's exec script preflight validator previously validated and then read a script by mutable pathname. A local race could swap the path between validation and read, causing preflight analysis to inspect a different file identity than the one that passed the workspace boundary check.
Affected Packages / Versions
- Package:
openclaw - Ecosystem: npm
- Affected versions:
< 2026.4.10 - Patched versions:
>= 2026.4.10
Technical Details
The vulnerable flow performed separate path validation and file reads in validateScriptFileForShellBleed. Because the read was path-based, an attacker with write access to the workspace path could race replacement of the target after validation but before preflight read.
Fix Commit(s)
b024fae9e5df43e9b69b2daebb72be3469d52e91(fix(exec): replace TOCTOU check-then-read with atomic pinned-fd open in script preflight [AI])- PR: #62333
Release Process Note
The fix first shipped in v2026.4.10. Users should upgrade to openclaw 2026.4.10 or newer; the latest npm release already includes the fix.
Credits
Thanks to @kikayli for reporting this issue.
Impact
The impact is limited. This was not arbitrary full-file disclosure through the preflight error path. The validator only surfaced derived preflight content, such as a matched token, a line number, or the first non-empty JavaScript line in one branch. Exploitation also required the ability to mutate the relevant workspace path during the preflight window.
Still, this was a real TOCTOU boundary bug in code that is supposed to reason about workspace-local script files before execution. A file identity that passed the initial boundary validation could differ from the identity that was later read for preflight analysis.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
PR #62333 replaced the check-then-read flow with a pinned safe-open/read path using the shared readFileWithinRoot helper. The fixed path performs boundary verification around the opened file identity and avoids relying on a mutable pathname for the final preflight read. Regression tests cover both pre-open and post-open swap windows.
Frequently Asked Questions
- What is CVE-2026-43529? CVE-2026-43529 is a low-severity security vulnerability in openclaw (npm), affecting versions < 2026.4.10. It is fixed in 2026.4.10.
- Which versions of openclaw are affected by CVE-2026-43529? openclaw (npm) versions < 2026.4.10 is affected.
- Is there a fix for CVE-2026-43529? Yes. CVE-2026-43529 is fixed in 2026.4.10. Upgrade to this version or later.
- Is CVE-2026-43529 exploitable, and should I be worried? Whether CVE-2026-43529 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-43529 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-43529? Upgrade
openclawto 2026.4.10 or later.