A time‑of‑check/time‑of‑use race condition in the OpenClaw OpenShell filesystem bridge permits an attacker to read files outside the permitted mount root. The flaw arises when a symlink can be swapped between the check that authorizes the file read and the use of that reference, thereby bypassing sandbox restrictions and exposing sensitive file contents. This vulnerability is a classic example of malicious symlink manipulation documented by CWE‑367, which compromises confidentiality for any data accessed beyond the intended directory scope.

The issue affects all installations of OpenClaw prior to the 2026.4.22 release. The affected product is OpenClaw, built on Node.js, and any deployment that utilizes the OpenShell filesystem bridge component before the patched version is at risk.

The CVSS score of 6 indicates a moderate severity vulnerability. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploit in the wild yet. The attack likely requires the ability to influence or supply files to the target system to orchestrate the symlink swap, which may require local or privileged access. Nonetheless, the potential to read arbitrary files underscores the risk to confidentiality if the attacker can leverage the OpenShell bridge component.