A path traversal vulnerability in Gitlawb OpenClaude versions prior to 0.5.1 permits unauthorized file system access, posing a significant risk to the integrity of the host environment.

The vulnerability resides in the bashToolHasPermission function within src/tools/BashTool/bashPermissions.ts, where an incorrect execution order allows commands to bypass path constraints. This flaw is reachable by a local user who can trigger the coding-agent command line interface with the sandbox auto-allow feature active.

The ability to bypass directory restrictions allows an attacker to read or write files outside of the intended sandbox environment, potentially leading to the compromise of sensitive system data. With a CVSS score of 8.4, this high-severity vulnerability represents a significant risk to confidential information and system integrity. Failure to remediate could allow an attacker to escalate their access within the host system.

Immediate Action: Update the OpenClaude package to version 0.5.1 or later via npm to ensure the logic flaw in permission checking is resolved.

Proactive Monitoring: Review system access logs for unusual command executions or attempts to access files outside of defined project directories.

Compensating Controls: Disable the sandbox auto-allow feature until the update can be applied to prevent the vulnerable logic path from being triggered.

Public Exploit Available: Unknown

Given the high CVSS score and the existence of a proof-of-concept, organizations using OpenClaude must treat this as a priority update. Upgrading to version 0.5.1 is the only reliable method to patch the underlying logic flaw and restore sandbox security. Organizations should verify their current version and implement the update immediately to prevent unauthorized file access.