CVE-2026-19008: mf-yang openclaw-cn RCE Vulnerability

CVE-2026-19008 Overview

CVE-2026-19008 is a symlink following vulnerability [CWE-59] affecting mf-yang openclaw-cn versions up to 0.2.1. The flaw resides in the assertNoSymlinkEscape function within src/agents/sandbox-paths.ts, part of the apply_patch tool component. Attackers can manipulate symbolic link resolution to escape the sandbox path enforcement intended by this function. The exploit is publicly available and can be launched remotely by authenticated users. The project maintainers were notified through an issue report but have not responded to the disclosure.

Critical Impact
Remote attackers with low privileges can exploit link following in the apply_patch tool to access or modify files outside the intended sandbox boundary, affecting confidentiality, integrity, and availability.

Affected Products

mf-yang openclaw-cn versions up to and including 0.2.1
Component: apply_patch tool
Affected file: src/agents/sandbox-paths.ts

Discovery Timeline

2026-08-06 - CVE CVE-2026-19008 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-19008

Vulnerability Analysis

The vulnerability exists in the assertNoSymlinkEscape function in src/agents/sandbox-paths.ts. This function is intended to prevent symbolic links from allowing file operations to escape the sandbox directory used by the apply_patch tool. The check fails to fully account for symbolic link resolution, permitting a symlink to point outside the sandbox boundary and be followed during patch application. Attackers who can supply patch input or place symlinks within the sandbox can redirect file reads or writes to arbitrary filesystem locations accessible to the process. The issue is classified as [CWE-59] Improper Link Resolution Before File Access (Link Following).

Root Cause

The root cause lies in incomplete path validation logic within assertNoSymlinkEscape. The function does not correctly canonicalize or reject paths whose resolution passes through symbolic links pointing outside the sandbox. Because the guard is bypassed, downstream file operations trust an unsafe path.

Attack Vector

A remote authenticated attacker triggers file operations through the apply_patch tool with input that leverages a symlink whose target lies outside the sandbox. When the tool resolves the path, the follow occurs and the operation acts on the attacker-chosen file. Public disclosure indicates the exploit has been released.

No verified proof-of-concept code has been reproduced here. See the GitHub PoC Repository and GitHub Issue #565 for technical details.

Detection Methods for CVE-2026-19008

Indicators of Compromise

Unexpected symbolic links created inside the openclaw-cn sandbox directory used by the apply_patch tool.
File modifications or reads on paths outside the sandbox root that correlate with apply_patch invocations.
Log entries from openclaw-cn showing patch application against files that resolve outside src/agents/sandbox-paths.ts allowed roots.

Detection Strategies

Audit filesystem activity of the openclaw-cn process for readlink, symlink, and open syscalls targeting paths outside the sandbox.
Compare canonicalized paths of files touched by apply_patch against the intended sandbox root and alert on mismatches.
Track versions of openclaw-cn in use and flag any instance at or below 0.2.1.

Monitoring Recommendations

Enable verbose logging on the apply_patch tool to capture input paths and resolved targets.
Monitor for creation of symbolic links by unprivileged users in directories accessed by openclaw-cn.
Alert on process file access patterns that traverse outside expected working directories.

How to Mitigate CVE-2026-19008

Immediate Actions Required

Restrict access to openclaw-cn deployments so only trusted authenticated users can invoke the apply_patch tool.
Run the openclaw-cn process under a dedicated low-privilege account with no read or write access outside the sandbox directory.
Disable or gate the apply_patch functionality until a patched release is available.

Patch Information

No vendor patch is available at time of publication. The project was notified through GitHub Issue #565 and GitHub Issue #566 but has not responded. Track the upstream repository at mf-yang/openclaw-cn for a fix and refer to the VulDB entry for CVE-2026-19008 for status updates.

Workarounds

Enforce filesystem-level sandboxing using OS primitives such as chroot, mount namespaces, or containers to contain any symlink escape.
Deny creation of symbolic links inside directories writable by the openclaw-cn process using filesystem ACLs or mount options such as nosymfollow where supported.
Pre-scan input passed to apply_patch and reject any path components that resolve through symbolic links.

bash

# Example: mount the sandbox directory with nosymfollow (Linux 5.10+)
mount -o remount,nosymfollow /var/lib/openclaw-cn/sandbox

# Example: run openclaw-cn under a restricted user with no access outside the sandbox
useradd -r -s /usr/sbin/nologin openclaw
chown -R openclaw:openclaw /var/lib/openclaw-cn/sandbox
chmod 700 /var/lib/openclaw-cn/sandbox