CVE-2026-100542 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in versions of the openclaw npm package ranging from 2026.5.28 up to, but not including, version 2026.8.1 represents a significant flaw in how archive listings are processed during the installation of tar.bz2 skills. This issue stems from an incorrect handling of bounded command-output suffixes within the extraction logic. Specifically, the software erroneously treats these truncated or partial output segments as complete and accurate representations of the entire archive contents. In standard archival formats such as bzip2-compressed tarballs, metadata regarding file counts and sizes is critical for security controls that prevent resource exhaustion attacks. By relying on incomplete listing data, the application fails to accurately assess the true scope of files contained within the package before proceeding with extraction operations.
This technical flaw enables a crafted malicious or compromised skill archive to bypass established safety mechanisms designed to limit resource consumption. The attacker can structure the archive in such a way that prohibited entries are pushed out of the retained listings due to the truncation error, while ensuring that the reported entry count and total size remain within acceptable thresholds defined by OpenClaw's extraction budgets. Consequently, when an operator reviews and approves the installation of this deceptive skill package, the system proceeds with full extraction based on false premises. The result is that files exceeding the allowed limits or surpassing maximum entry counts are persisted in the skill tools directory. This behavior directly undermines the integrity of resource management policies intended to protect the host environment from excessive disk usage or inode exhaustion.
The operational impact of this vulnerability primarily involves denial-of-service conditions through resource consumption rather than immediate code execution. While the flaw does not inherently allow for arbitrary command execution by itself, it facilitates a persistent state where malicious artifacts reside on the system. Over-limit files consume valuable disk space and inodes, potentially degrading system performance or causing failures in other services that depend on available storage resources. Furthermore, because these files are persisted within the skill tools directory, they may serve as footholds for further exploitation if subsequent processes interact with them without proper validation. The trust model of OpenClaw relies heavily on operator approval; therefore, this vulnerability exploits human oversight by presenting a seemingly compliant package that secretly violates resource constraints upon installation.
From a classification perspective, this issue aligns with CWE-787 Out-of-bounds Write in the context of data handling and potentially CWE-20 Improper Input Validation regarding the archive metadata processing. It also relates to CWE-409 Missing Handling of Unusual or Complex Data if considering the malformed nature of crafted archives designed to exploit this logic error. In terms of adversarial tactics, this vulnerability supports techniques associated with ATT&CK T1568 Dynamic Resolution which involves deploying software components that evade detection by appearing compliant until execution time, and potentially T1496 Resource Hijacking where system resources are consumed for disruptive purposes or as a precursor to more severe attacks. The bypass of extraction budgets is particularly concerning as it indicates a failure in the defense-in-depth strategy employed by the application framework.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary and most effective mitigation is upgrading the openclaw package to version 2026.8.1 or later, where this logic error has been corrected. For environments unable to upgrade immediately, operators should exercise extreme caution when installing skill archives from untrusted sources, verifying their integrity through external checksums if available. Additionally, implementing stricter file system monitoring and quota enforcement at the operating system level can provide a secondary layer of protection against inode exhaustion or disk space depletion caused by such vulnerabilities. Future development efforts should prioritize robust parsing libraries that validate archive metadata independently of command output streams to ensure accurate assessment of all contained entries before any extraction takes place.