Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

OpenClaw skill installer can exceed file limits

CVE-2026-100542 · published 23 days ago
Summary

The OpenClaw tool (versions from 2026.5.28 up to before 2026.8.1) can be tricked into unpacking a skill package that contains more files or larger data than the program expects. If you approve such a package, it may fill up disk space or use up file system entries, potentially affecting system performance. Update OpenClaw to version 2026.8.1 or later to stop this from happening.

What to do
  • Update openclaw openclaw to version 2026.8.1 or later.
Affected software
VendorProductAffected versions
openclaw openclaw < 2026.8.1
Original advisory text
OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published26 Sep 2026
Updated16 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100542 · NVD
CVE-2026-100542 · MITRE
CVE-2026-100542 · OSV
GHSA-6xpv-wwr5-265h · GHSA
Track software like this
Free during beta