CVE-2026-19008: symlink escape bypasses agent

CISO Take

A flaw in the assertNoSymlinkEscape check inside openclaw-cn's apply_patch tool lets an attacker craft a symlink that the sandbox path validator fails to catch, so file writes meant to stay inside the agent's workspace instead follow the link and land outside it. This matters because apply_patch is the core file-editing primitive of an AI coding agent — a broken boundary here is a direct sandbox escape, not a cosmetic bug, and it's remotely reachable with only low privileges and no user interaction (CVSS 6.3, AV:N/PR:L/UI:N). Real-world exploitation pressure is currently low — EPSS sits at 0.34%, it's not in CISA KEV, and CISA's SSVC decision is TRACK_STAR, the lowest-urgency tier — but the maintainer was notified via GitHub issue and has not responded, so no patched version exists yet. Until a fix ships, treat any repository or workspace content that openclaw-cn processes as untrusted: reject or canonically resolve symlinks before apply_patch touches them, run the agent in a hardened container with no access to sensitive host paths, and alert on sandbox file writes that resolve outside the expected working directory.

Sources: NVD EPSS CISA SSVC ATLAS GitHub VulDB

What is the risk?

Objectively medium severity (CVSS 6.3) but the exploit mechanics are simple — network-reachable, low complexity, low privileges, no user interaction — which lowers the bar for anyone with basic access to an openclaw-cn deployment. Countervailing factors keep near-term risk moderate rather than critical: EPSS is very low (0.34%, well below typical actively-exploited thresholds), the CVE is absent from CISA KEV, SSVC classifies it as TRACK_STAR (lowest urgency), and there is no confirmed public exploit code or Nuclei template. The unresponsive maintainer is the main risk amplifier: with no patch timeline, exposure persists indefinitely for anyone running this project, and the vulnerability class (symlink/link-following, CWE-59) is a well-understood, easily automatable bug pattern once someone writes a PoC.

How does the attack unfold?

Entry Point

An attacker with low-privileged access to an openclaw-cn deployment places a symlink inside a workspace/repository the agent will process, pointing to a file outside the intended sandbox.

AML.T0053

Exploitation

The agent's apply_patch tool is invoked to modify the symlinked path; the flawed assertNoSymlinkEscape check fails to detect the link resolves outside the sandbox root (CWE-59 Link Following).

AML.T0105

Impact

The write follows the symlink and lands on the real target file outside the sandbox boundary, letting the attacker overwrite or corrupt sensitive files and potentially achieve persistence or downstream code execution.

AML.T0101

Entry Point

An attacker with low-privileged access to an openclaw-cn deployment places a symlink inside a workspace/repository the agent will process, pointing to a file outside the intended sandbox.

AML.T0053

Exploitation

The agent's apply_patch tool is invoked to modify the symlinked path; the flawed assertNoSymlinkEscape check fails to detect the link resolves outside the sandbox root (CWE-59 Link Following).

AML.T0105

Impact

The write follows the symlink and lands on the real target file outside the sandbox boundary, letting the attacker overwrite or corrupt sensitive files and potentially achieve persistence or downstream code execution.

AML.T0101

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

1) No patch is currently available — the maintainer has not responded to the report, so track https://github.com/mf-yang/openclaw-cn/issues/565 and /566 for updates. 2) Until fixed, do not run openclaw-cn's apply_patch tool against untrusted or externally-supplied repositories/workspaces (e.g., third-party PRs, cloned public repos) without additional isolation. 3) Wrap the agent in defense-in-depth sandboxing independent of the app's own checks: run it in a container/VM with a read-only or minimally-writable host filesystem, no bind-mounts to sensitive paths, and mandatory access controls (AppArmor/SELinux/seccomp) that block following symlinks outside the workspace root. 4) Detection: monitor file-write syscalls or audit logs for the apply_patch process resolving paths outside the expected workspace root, and flag any symlink creation inside directories the agent operates on prior to a patch operation. 5) If forking/patching internally, fix assertNoSymlinkEscape to resolve the real (canonical) path via realpath/fs.realpathSync and verify it remains within the sandbox root before any write, rather than validating the pre-resolution path string.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0101 - Data Destruction via AI Agent Tool Invocation AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.2 - Operational planning and control of the AI system lifecycle

NIST AI RMF

MANAGE-2.3 - Manage risks and benefits from third-party AI resources

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-19008?

A flaw in the assertNoSymlinkEscape check inside openclaw-cn's apply_patch tool lets an attacker craft a symlink that the sandbox path validator fails to catch, so file writes meant to stay inside the agent's workspace instead follow the link and land outside it. This matters because apply_patch is the core file-editing primitive of an AI coding agent — a broken boundary here is a direct sandbox escape, not a cosmetic bug, and it's remotely reachable with only low privileges and no user interaction (CVSS 6.3, AV:N/PR:L/UI:N). Real-world exploitation pressure is currently low — EPSS sits at 0.34%, it's not in CISA KEV, and CISA's SSVC decision is TRACK_STAR, the lowest-urgency tier — but the maintainer was notified via GitHub issue and has not responded, so no patched version exists yet. Until a fix ships, treat any repository or workspace content that openclaw-cn processes as untrusted: reject or canonically resolve symlinks before apply_patch touches them, run the agent in a hardened container with no access to sensitive host paths, and alert on sandbox file writes that resolve outside the expected working directory.

Is CVE-2026-19008 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-19008, increasing the risk of exploitation.

How to fix CVE-2026-19008?

1) No patch is currently available — the maintainer has not responded to the report, so track https://github.com/mf-yang/openclaw-cn/issues/565 and /566 for updates. 2) Until fixed, do not run openclaw-cn's apply_patch tool against untrusted or externally-supplied repositories/workspaces (e.g., third-party PRs, cloned public repos) without additional isolation. 3) Wrap the agent in defense-in-depth sandboxing independent of the app's own checks: run it in a container/VM with a read-only or minimally-writable host filesystem, no bind-mounts to sensitive paths, and mandatory access controls (AppArmor/SELinux/seccomp) that block following symlinks outside the workspace root. 4) Detection: monitor file-write syscalls or audit logs for the apply_patch process resolving paths outside the expected workspace root, and flag any symlink creation inside directories the agent operates on prior to a patch operation. 5) If forking/patching internally, fix assertNoSymlinkEscape to resolve the real (canonical) path via realpath/fs.realpathSync and verify it remains within the sandbox root before any write, rather than validating the pre-resolution path string.

What systems are affected by CVE-2026-19008?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed code execution / AI coding agents, apply_patch / file-editing agent tools.

What is the CVSS score for CVE-2026-19008?

CVE-2026-19008 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworkssandboxed code execution / AI coding agentsapply_patch / file-editing agent tools

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0101 Data Destruction via AI Agent Tool Invocation

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.2

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with low-privileged access to a system running openclaw-cn (e.g., a collaborator on a shared workspace, or a contributor whose repo content the agent will process) places a symlink inside the workspace directory that points to a sensitive path outside the sandbox — for example, a config file, SSH key, or a script that gets executed later. When the agent is instructed (directly or via a crafted prompt/patch request) to modify a file at that symlinked path using apply_patch, the vulnerable assertNoSymlinkEscape check fails to detect that the target resolves outside the sandbox, and the write follows the link. The attacker's content is written to the real target file outside the intended boundary, achieving sandbox escape and potentially persistence or downstream code execution if the overwritten file is later loaded or run.

Weaknesses (CWE)

CWE-59 Improper Link Resolution Before File Access ('Link Following') Primary CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.