CVE-2026-27485: OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Vulnerability

skills/skill-creator/scripts/packageskill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives.

If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents.

Severity and Exposure

- Severity: Low - Execution context: local/manual workflow only (skill author packaging step) - No remote trigger: this is not reachable via normal OpenClaw gateway/chat runtime paths - No extraction Zip Slip in this finding: this issue is limited to packaging-time symlink following

Impact

- Potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact. - Requires local execution of the packaging script on attacker-controlled skill contents.

Affected Components

- skills/skill-creator/scripts/packageskill.py

Affected Packages / Versions

- Package: openclaw (npm) - Latest published version during triage: 2026.2.17 - Vulnerable version range: <= 2026.2.17 - Planned patched version (next release): 2026.2.18

Remediation

- Reject symlinks during skill packaging. - Add regression tests for symlink file and symlink directory cases. - Update packaging guidance to document the symlink restriction.

Fix Commit(s)

- c275932aa4230fb7a8212fe1b9d2a18424874b3f - ee1d6427b544ccadd73e02b1630ea5c29ba9a9f0

Related PR

- https://github.com/openclaw/openclaw/pull/20796

Release Process Note

patchedversions is pre-set to the planned next release (2026.2.18). Once npm openclaw@2026.2.18 is published, this advisory is ready to publish without additional edits.

Thanks @aether-ai-agent for reporting.