CVE-2026-100542
Received Received - Intake

Path Traversal in OpenClaw npm Package

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100542
EUVD
EUVD-2026-87508

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100542 affects the OpenClaw npm package versions between 2026.5.28 and 2026.8.1. The vulnerability involves the tar.bz2 skill installer mishandling archive listings by treating incomplete command-output suffixes as complete listings. This allows crafted archives to bypass size and entry checks, enabling full extraction despite OpenClaw's limits. The issue does not execute archive contents but can cause disk space or inode exhaustion if a malicious archive is installed.

Detection Guidance

To detect this vulnerability, inspect installed OpenClaw versions with 'npm list openclaw' or check version files in the package directory. Monitor disk space and inode usage in the skill tools directory for unexpected increases. Use 'tar -tvf archive.tar.bz2' to manually verify archive contents before installation.

Impact Analysis

This vulnerability can lead to disk space or inode exhaustion in the skill tools directory if an operator approves installation of a malicious or compromised skill archive. It bypasses OpenClaw's extraction budgets but does not directly execute archive contents. Users should avoid installing untrusted .tar.bz2 or .tbz2 skills and upgrade to version 2026.8.1 or later.

Compliance Impact

This vulnerability primarily impacts availability by allowing excessive disk space or inode consumption through bypassed extraction limits. While it does not directly expose or leak data, overconsumption of resources could interfere with system logging or audit mechanisms required by GDPR and HIPAA. However, the vulnerability itself does not directly violate these standards.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later immediately. Avoid installing .tar.bz2 or .tbz2 skills from untrusted sources. Inspect archives with bounded tools before installation. Monitor disk space and inode usage in the skill tools directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart