CVE-2026-32018 OpenClaw沙箱竞态条件漏洞

import threading import time # Simulated registry storage registry = {"sandbox_01": "active", "sandbox_02": "active"} def vulnerable_update(key, value): """Simulates updateRegistry without locking""" print(f"[Update] Reading key: {key}") current_val = registry.get(key) time.sleep(0.01) # Simulate processing delay (Race Window) print(f"[Update] Writing key: {key}") registry[key] = value def vulnerable_remove(key): """Simulates removeRegistryEntry without locking""" print(f"[Remove] Deleting key: {key}") time.sleep(0.005) # Simulate processing delay if key in registry: del registry[key] print(f"[Remove] Key {key} deleted") # Exploit execution print("Initial State:", registry) t1 = threading.Thread(target=vulnerable_update, args=("sandbox_01", "inactive")) t2 = threading.Thread(target=vulnerable_remove, args=("sandbox_01",)) t1.start() t2.start() t1.join() t2.join() print("Final State (Potentially Corrupted):", registry)