Nixpkgs security tracker

Dismissed

Permalink CVE-2026-32044

5.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

updated 1 month, 1 week ago by @pyrox0 Activity log

Created suggestion 1 month, 1 week ago
@pyrox0 dismissed 1 month, 1 week ago

OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation

OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats. Attackers can craft malicious tar.bz2 skill archives to bypass special-entry blocking and extracted-size guardrails, causing local denial of service during skill installation.

References

GitHub Security Advisory (GHSA-77hf-7fqf-f227) third-party-advisory
Patch Commit patch
VulnCheck Advisory: OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation third-party-advisory

Affected products

OpenClaw

<2026.3.2
==2026.3.2

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

nixos-unstable 2026.3.12
- nixpkgs-unstable 2026.3.12
- nixos-unstable-small 2026.3.12

Package maintainers

@chrisportela Chris Portela <chris@chrisportela.com>

version packaged is not vulnerable

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.openclaw

Package maintainers