OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal
Date: 2026-04
Affected: npm/@gitlawb/openclaude
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-35570
CWE: CWE-22
CWE-284
CVSS: 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

A logic flaw exists in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an `allow` result immediately — before the path constraint filter (`checkPathConstraints`) is ever evaluated. This allows commands containing path traversal sequences (e.g., `../../../../../etc/passwd`) to bypass directory restrictions entirely. ## Affected Component - **File:** `src/tools/BashTool/bashPermissions.ts` - **Function:** `bashToolHasPermission` - **Location:** ~line 1445 (sandbox auto-allow block) ## Vulnerable Code Flow ``` bashToolHasPermission() │ ├─ [~1445] Sandbox auto-allow block │ └─ No deny rule found → return ALLOW ⚠️ Early exit │ └─ [~1644] checkPathConstraints() ❌ Never reached ``` The sandbox block was designed to skip interactive permission prompts in sandboxed environments. However, it unintentionally also skips the path traversal filter, which is a separate and critical security control. ## Impact Any process or user operating in a sandboxed session with no explicit deny rules can: - Read arbitrary files outside the sandbox boundary (e.g., `/etc/passwd`, `/etc/shadow`, `.env` files, SSH private keys) - Write to arbitrary paths (subject to OS-level permissions) - Fully defeat the filesystem isolation that the sandbox is intended to enforce ## Steps to Reproduce 1. Enable sandbox mode: `SandboxManager


Mitigations:

Architectural layers (MAESTRO):