OpenClaude Path Traversal Bypasses Sandbox Controls

The National Vulnerability Database has detailed CVE-2026-35570, a high-severity logic flaw in OpenClaude, an open-source coding-agent CLI. The vulnerability, rated 8.4 CVSS, specifically impacts versions prior to 0.5.1. It stems from a flaw in the bashToolHasPermission() function within src/tools/BashTool/bashPermissions.ts.

When OpenClaude’s sandbox auto-allow feature is active and no explicit deny rules are configured, the function prematurely grants permission. This bypasses the critical checkPathConstraints filter. Consequently, an attacker can execute commands containing path traversal sequences, such as ../../../../../etc/passwd, to escape intended directory restrictions and potentially access sensitive files or execute arbitrary commands outside the sandbox.

This flaw highlights a common security pitfall: assuming default configurations provide adequate protection. Defenders relying on OpenClaude for development or automation workflows must understand that an active auto-allow feature, without explicit deny rules, renders path constraints ineffective. Version 0.5.1 contains the necessary patch, making immediate upgrades critical to prevent unauthorized system access.