CVE-2026-35570

Katalog CVE

CVSS 8.4 · High EPSS 0,19%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada gitlawb openclaude. Skor CVSS 3.1 8.4 (High) menurut github.com.

Deskripsi (NVD)

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an `allow` result immediately — before the path constraint filter (`checkPathConstraints`) is ever evaluated. This allows commands containing path traversal sequences (e.g., `../../../../../etc/passwd`) to bypass directory restrictions entirely. Version 0.5.1 contains a patch for the issue.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.4 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-284: Improper Access Control

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m6rx-7pvw-2f73 exploit · mitigasi · advisory vendor
• https://github.com/Gitlawb/openclaude/commit/7002cb302b78ea2a19da3f26226de24e2903fa1d patch