[openclaw] OpenClaw has Zip Slip path traversal in tar archive extraction

**[openclaw] OpenClaw has Zip Slip path traversal in tar archive extraction**

Summary OpenClaw versions before 2026.2.14 did not sufficiently validate TAR archive entry paths during extraction. A crafted archive could use path traversal sequences (for example ../../...) to write files outside the intended destination directory (Zip Slip). Affected Packages / Versions Package: openclaw (npm) Affected: < 2026.2.14 Fixed: >= 2026.2.14 Details The affected code path is extractArchive() in src/infra/archive.ts. Prior to 2026.2.14, TAR extraction used tar.x({ cwd: destDir }) without rejecting traversal and absolute entry paths. This extraction is used by installation flows such as: openclaw plugins install … openclaw hooks install … Impact If a user installs an untrusted .tar / .tgz archive, an attacker can write files outside the extraction directory (within the permissions of the OpenClaw process)...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.