highCVSS 7.5Vulnerability
GHSA-wr92-6w3g-2hwc
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p7gr-f84w-hqg5. This link is maintained to preserve external references. ## Original Description OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.
Properties
- ghsa_id
- GHSA-wr92-6w3g-2hwc
- summary
- Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
- severity
- high
- cvss_score
- 7.5
- cve_id
- GHSA-wr92-6w3g-2hwc
- cvss_vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- is_ghsa_only
- true
- ghsa_published
- 2026-03-21T03:31:13Z
- source_url
- https://github.com/advisories/GHSA-wr92-6w3g-2hwc
- ghsa_updated
- 2026-03-27T20:15:23Z
Related Entities (3)
AFFECTS (1)
→[Software]npm/OpenClaw
REPORTED_BY (1)
→[Source]GitHub Advisory Database
HAS_WEAKNESS (1)
→[Weakness]Incorrect Permission Assignment for Critical Resource
Explore deeper with Ninja Signal's threat intelligence graph