OpenClaw, an npm package, is vulnerable to a time‑of‑check time‑of‑use race condition in file system mutation operations performed by its OpenShell local mirror component. The vulnerable remove, mkdir, and rename functions may act on a different target after the sandbox safety check if the path is altered concurrently. If an attacker wins the race, they can delete, create, or rename a host file outside the intended mirror root using the process’s privileges. This can lead to data loss or tampering and effectively bypasses the sandbox designed to isolate OpenClaw operations.

The issue affects installations of the OpenClaw npm package before version 2026.7.1. Users running any vulnerable version of OpenClaw should assess whether the package is in use and whether their deployment allows concurrent filesystem changes to the mirror directory.

The vulnerability has a CVSS score of 8.8 and is not listed in the CISA KEV catalog. EPSS data is not available, implying current exploitation likelihood is uncertain. Based on the description, the attack vector is inferred to be a local or application‑level race where the adversary can influence file paths or trigger concurrent operations; external attackers would need to interact with the OpenClaw process to trigger the race. The risk remains high due to the potential to manipulate critical files with the process’s permissions, but the exploitability is limited to environments where OpenClaw’s file operations can be concurrently modified.