{"id":"GHSA-77hf-7fqf-f227","summary":"OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)","details":"### Summary\nThe `tar.bz2` installer path in `src/agents/skills-install-download.ts` used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor.\n\nThis allowed crafted `.tar.bz2` archives to bypass special-entry blocking and extracted-size guardrails enforced on other archive paths, causing local availability impact during skill install.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published at triage time: `2026.3.1`\n- Affected range: `\u003c= 2026.3.1`\n- Patched in: `2026.3.2` (released)\n\n### Impact\nLocal DoS / availability impact when processing untrusted `.tar.bz2` skill archives.\n\n### Fix Commit(s)\n- `0dbb92dd2bcf9a32379d11c0f11ed016669dae3e`\n\n### Related advisories\n- Canonical overlap (closed): GHSA-3pj7-x8jr-jvj8\n- Duplicate variant (closed): GHSA-rgr7-g85h-6v82","aliases":["CVE-2026-32044"],"modified":"2026-04-02T13:26:35.398565317Z","published":"2026-03-03T21:32:35Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-03-03T21:32:35Z","nvd_published_at":null,"cwe_ids":["CWE-400","CWE-409"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77hf-7fqf-f227"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/0dbb92dd2bcf9a32379d11c0f11ed016669dae3e"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"affected":[{"package":{"name":"openclaw","ecosystem":"npm","purl":"pkg:npm/openclaw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.3.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-77hf-7fqf-f227/GHSA-77hf-7fqf-f227.json","last_known_affected_version_range":"\u003c= 2026.3.1"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}