OpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an `allow` result immediately — before the path constraint filter (`checkPathConstraints`) is ever evaluated. This allows commands containing path traversal sequences (e.g., `../../../../../etc/passwd`) to bypass directory restrictions entirely. Version 0.5.1 contains a patch for the issue.

Source published

20 Apr 2026 23:24:08 UTC

Source modified

21 Apr 2026 19:49:30 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an `allow` result immediately — before the path constraint filter (`checkPathConstraints`) is ever evaluated. This allows commands containing path traversal sequences (e.g., `../../../../../etc/passwd`) to bypass directory restrictions entirely. Version 0.5.1 contains a patch for the issue.

Source published

Apr 20, 2026, 11:24:08 PM (timezone not stated)

Source modified

Apr 21, 2026, 7:49:30 PM (timezone not stated)

Observed here

28 Oct 2026 04:56:10 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an `allow` result immediately — before the path constraint filter (`checkPathConstraints`) is ever evaluated. This allows commands containing path traversal sequences (e.g., `../../../../../etc/passwd`) to bypass directory restrictions entirely. Version 0.5.1 contains a patch for the issue.

Source published

21 Apr 2026 00:16:28 UTC

Source modified

26 Oct 2026 21:10:00 UTC

Observed here

27 Oct 2026 09:03:12 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

A logic flaw exists in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is active and no explicit deny rule is configured, the function returns an `allow` result immediately — before the path constraint filter (`checkPathConstraints`) is ever evaluated. This allows commands containing path traversal sequences (e.g., `../../../../../etc/passwd`) to bypass directory restrictions entirely. ## Affected Component - **File:** `src/tools/BashTool/bashPermissions.ts` - **Function:** `bashToolHasPermission` - **Location:** ~line 1445 (sandbox auto-allow block) ## Vulnerable Code Flow ``` bashToolHasPermission() │ ├─ [~1445] Sandbox auto-allow block │ └─ No deny rule found → return ALLOW ⚠️ Early exit │ └─ [~1644] checkPathConstraints() ❌ Never reached ``` The sandbox block was designed to skip interactive permission prompts in sandboxed environments. However, it unintentionally also skips the path traversal filter, which is a separate and critical security control. ## Impact Any process or user operating in a sandboxed session with no explicit deny rules can: - Read arbitrary files outside the sandbox boundary (e.g., `/etc/passwd`, `/etc/shadow`, `.env` files, SSH private keys) - Write to arbitrary paths (subject to OS-level permissions) - Fully defeat the filesystem isolation that the sandbox is intended to enforce ## Steps to Reproduce 1. Enable sandbox mode: `SandboxManager.isSandboxingEnabled() = true` 2. Enable auto-allow: `SandboxManager.isAutoAllowBashIfSandboxedEnabled() = true` 3. Ensure no explicit deny rules are configured for the session 4. Submit a bash command with a path traversal payload: ``` cat ../../../../../etc/passwd ``` 5. Observe that the command receives `behavior: allow` without triggering `checkPathConstraints` ## Recommended Fix The sandbox auto-allow block should **never short-circuit the full permission pipeline**. It may suppress interactive prompts, but path constraint validation must always execute. ### Option 1 — Preferred: Continue pipeline on `allow` Only return early for `deny` or `ask` behaviors. Let `allow` fall through to `checkPathConstraints`: ```typescript if ( SandboxManager.isSandboxingEnabled() && SandboxManager.isAutoAllowBashIfSandboxedEnabled() && shouldUseSandbox(input) ) { const sandboxAutoAllowResult = checkSandboxAutoAllow( input, appState.toolPermissionContext, ); if (sandboxAutoAllowResult.behavior !== 'allow') { // Only block or prompt — never skip path checks on allow return sandboxAutoAllowResult; } // If 'allow', continue to checkPathConstraints below } ``` ### Option 2 — Defense in depth: Run path check before returning Run `checkPathConstraints` explicitly inside the sandbox block before returning: ```typescript if (sandboxAutoAllowResult.behavior !== 'passthrough') { const pathCheck = checkPathConstraints(input, appState.toolPermissionContext); if (pathCheck.behavior !== 'allow') { return pathCheck; // Block traversal attempts even in sandbox } return sandboxAutoAllowResult; } ``` ### Option 3 — Minimal change: Move sandbox block after path check Reorder the function so `checkPathConstraints` always runs first, and the sandbox block only handles the prompt-suppression logic afterward. --- Credit: Elvin Latifli (@Rickidevs )

Source published

21 Apr 2026 15:16:16 UTC

Source modified

21 Apr 2026 15:56:31 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Publisher rating · HIGH