CVE-2026-45224: OpenClaw path traversal enables

CISO Take

Crabbox, an AI agent sandbox/workspace tool, resolves workspace paths from user-supplied .crabbox.yaml configuration without validating that the result stays inside the intended /workspace directory, so a crafted config with traversal sequences can point the tool's rm -rf and mkdir -p workspace-prep logic anywhere on the filesystem. The blast radius looks contained on paper — only 4 known downstream dependents, no CISA KEV listing, and no public exploit or Nuclei template exist yet — but the EPSS model ranks it in the top 4% most likely to see exploitation attempts, and triggering it needs no privileges and only a single user interaction (opening or running a malicious project). Because the bug destroys data rather than exfiltrates it (CVSS Integrity and Availability both High, Confidentiality None), a successful hit shows up as sudden, unexplained loss or overwrite of local files rather than a classic breach signal. Upgrade any Crabbox installation to 0.9.0 now, and until then treat sync.delete as untrusted-input-facing: disable it for any workspace opened from an external or unreviewed repository. For detection, flag rm -rf/mkdir -p invocations from agent-tool workspace-prep logic that target paths outside the expected project root.

Sources: NVD EPSS CISA KEV GitHub vulncheck.com ATLAS

What is the risk?

Moderate-to-high severity (CVSS 7.1) driven by a fully destructive Integrity+Availability impact with no privileges required, offset by a local attack vector and mandatory user interaction that caps mass exploitability. EPSS is numerically low (0.00144) but sits at the 96th percentile among AI-related CVEs, meaning it's more likely to be targeted than most peers even though absolute exploitation volume is currently low. No CISA KEV entry, no public PoC, and no scanner template exist, so this is not yet an active-exploitation concern — but the trivial exploit mechanics (a text config file with a traversal string) mean that could change quickly once a working PoC circulates, especially given the vulnerable component's package risk score of 0/100 and a track record of 447 other CVEs in the same package family.

How does the attack unfold?

Malicious config delivery

Attacker publishes or contributes a project containing a crafted .crabbox.yaml with path traversal sequences in the workspace path and sync.delete enabled.

AML.T0081

Trust and execution

A victim developer or an AI agent opens/runs the project, causing Crabbox's Islo provider to begin workspace preparation using the attacker-controlled config.

AML.T0011

Path resolution escape

The workspace path resolver fails to validate the input, resolving the traversal sequence to a location outside the intended /workspace directory.

Destructive impact

Crabbox executes rm -rf and mkdir -p on the resolved out-of-bounds path, causing arbitrary file deletion or overwrite outside the sandbox.

AML.T0101

Malicious config delivery

Attacker publishes or contributes a project containing a crafted .crabbox.yaml with path traversal sequences in the workspace path and sync.delete enabled.

AML.T0081

Trust and execution

A victim developer or an AI agent opens/runs the project, causing Crabbox's Islo provider to begin workspace preparation using the attacker-controlled config.

AML.T0011

Path resolution escape

The workspace path resolver fails to validate the input, resolving the traversal sequence to a location outside the intended /workspace directory.

Destructive impact

Crabbox executes rm -rf and mkdir -p on the resolved out-of-bounds path, causing arbitrary file deletion or overwrite outside the sandbox.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C None

I High

A High

What should I do?

1 step

1) Upgrade Crabbox to 0.9.0 or later, which fixes the path resolution in commit 6b07193f (see the linked PR #65 and release notes). 2) Until upgraded, disable sync.delete for any workspace whose .crabbox.yaml/crabbox.yaml originates from an untrusted or externally-supplied repository. 3) Add filesystem sandboxing (containers, chroot, restricted service accounts) around any process that invokes Crabbox workspace preparation, so a resolved-path escape can't reach sensitive host files even if exploited. 4) Audit logs/history for rm -rf or mkdir -p operations issued by Crabbox against paths outside the configured /workspace root as a compromise indicator. 5) Review any repositories or projects opened with Crabbox prior to patching for signs of unexpected file loss.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain DoS Agent AML.T0011 - User Execution AML.T0081 - Modify AI Agent Configuration AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI System Security and Resilience

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-45224?

Crabbox, an AI agent sandbox/workspace tool, resolves workspace paths from user-supplied .crabbox.yaml configuration without validating that the result stays inside the intended /workspace directory, so a crafted config with traversal sequences can point the tool's rm -rf and mkdir -p workspace-prep logic anywhere on the filesystem. The blast radius looks contained on paper — only 4 known downstream dependents, no CISA KEV listing, and no public exploit or Nuclei template exist yet — but the EPSS model ranks it in the top 4% most likely to see exploitation attempts, and triggering it needs no privileges and only a single user interaction (opening or running a malicious project). Because the bug destroys data rather than exfiltrates it (CVSS Integrity and Availability both High, Confidentiality None), a successful hit shows up as sudden, unexplained loss or overwrite of local files rather than a classic breach signal. Upgrade any Crabbox installation to 0.9.0 now, and until then treat sync.delete as untrusted-input-facing: disable it for any workspace opened from an external or unreviewed repository. For detection, flag rm -rf/mkdir -p invocations from agent-tool workspace-prep logic that target paths outside the expected project root.

Is CVE-2026-45224 actively exploited?

No confirmed active exploitation of CVE-2026-45224 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-45224?

1) Upgrade Crabbox to 0.9.0 or later, which fixes the path resolution in commit 6b07193f (see the linked PR #65 and release notes). 2) Until upgraded, disable sync.delete for any workspace whose .crabbox.yaml/crabbox.yaml originates from an untrusted or externally-supplied repository. 3) Add filesystem sandboxing (containers, chroot, restricted service accounts) around any process that invokes Crabbox workspace preparation, so a resolved-path escape can't reach sensitive host files even if exploited. 4) Audit logs/history for rm -rf or mkdir -p operations issued by Crabbox against paths outside the configured /workspace root as a compromise indicator. 5) Review any repositories or projects opened with Crabbox prior to patching for signs of unexpected file loss.

What systems are affected by CVE-2026-45224?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed/isolated execution environments, AI coding agent workspaces.

What is the CVSS score for CVE-2026-45224?

CVE-2026-45224 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

agent frameworkssandboxed/isolated execution environmentsAI coding agent workspaces

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0081 Modify AI Agent Configuration

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.

Exploitation Scenario

An attacker publishes or contributes to a project containing a crafted .crabbox.yaml whose workspace path uses traversal sequences (e.g., pointing at a user's home directory or a shared build path) and enables sync.delete. A developer or an AI coding agent operating on the attacker's behalf clones the project and invokes Crabbox to prepare the workspace. Crabbox's Islo provider resolves the malicious path without validating it stays under /workspace, then runs rm -rf on the resolved (out-of-bounds) path followed by mkdir -p, silently wiping or overwriting files well outside the intended sandbox — resulting in data loss, corrupted local state, or disruption of the victim's development environment.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.