Security researchers have disclosed three vulnerabilities—now fixed—in OpenClaw, a personal AI assistant, that together could have allowed attackers to steal credentials, escalate their privileges, and run arbitrary code on affected machines. Technical write-ups on the flaws are available in the OpenClaw CVE repository.

All three issues were rated high severity. Here's a rundown:

Notably, exploiting these newly discovered flaws doesn't require an attacker to already have a foothold on the system. From that starting point alone, they could pull sensitive data, plant a backdoor that survives reboots, achieve full remote code execution, and break out of the sandbox to reach the underlying host. Explaining the root cause behind GHSA-575v-8hfq-m3mc, the researcher noted that the function responsible for validation only tests whether the source path falls within a blocked directory—it never checks the inverse case, where a blocked path could itself sit inside the source directory. That gap is what makes the parent-directory bypass possible