CVE-2026-32232 — zeptoclaw
Fix: qhkm/zeptoclaw@f50c17eCVE-2026-32232 is a Path Traversal vulnerability in zeptoclaw. A fix is available for zeptoclaw — see the affected versions and patch details below.
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-32232.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
zeptoclawReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Workspace boundary enforcement currently has three related bypass risks. This issue tracks fixing all three in one pull request.
Details
R1 - Dangling Symlink Component Bypass
- What happens: Path validation can miss dangling symlink components during traversal checks.
- Why it matters: A symlink that is unresolved at validation time can later resolve to an external location.
- Impact: Read and write operations may escape workspace boundaries.
- Affected area: src/security/path.rs (check_symlink_escape).
R2 - TOCTOU Between Validation and Use
- What happens: The path is validated first, then used later for filesystem operations.
- Why it matters: A concurrent filesystem change can swap path components after validation but before open/write.
- Impact: Race-based workspace escape is possible.
- Affected area: Filesystem and file-consuming tools that call validate_path_in_workspace before I/O.
R3 - Hardlink Alias Bypass
- What happens: A file inside workspace can be a hardlink to an inode outside the intended workspace trust boundary.
- Why it matters: Prefix and symlink checks can pass while data access still mutates or reads external content.
- Impact: Policy bypass for read/write operations.
- Affected area: Any tool that reads or writes via validated paths.
Risk Matrix
| ID | Risk | Severity | Likelihood | Impact |
|---|---|---|---|---|
| R1 | Dangling symlink component bypass | High | Medium | Workspace boundary escape for read/write |
| R2 | Validate/use TOCTOU race | High | Medium | Race-based boundary escape during file I/O |
| R3 | Hardlink alias bypass | Medium | Low-Medium | External inode read/write through in-workspace path |
PoC
R1 - Dangling symlink component bypass
- Create a symlink inside workspace pointing to a missing target.
- Validate a path traversing that symlink.
- Create the target directory outside workspace after validation.
- Perform file operation and observe potential boundary escape if not fail-closed.
R2 - TOCTOU between validation and use
- Validate a candidate in-workspace path.
- Before open/write, replace an intermediate component with a link to external location.
- Continue with the file operation.
- Observe boundary escape if operation trusts only stale validation result.
R3 - Hardlink alias bypass
- Place a hardlink inside workspace that points to an external inode.
- Validate the in-workspace hardlink path.
- Read or write through this path.
- Observe external inode access through a path that appears in-scope.
Impacts
Unauthorized cross path boundary
Credit
Patch
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | zeptoclaw | all versions | 0.7.6cargo update -p zeptoclaw --precise 0.7.6 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zeptoclaw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update zeptoclaw to 0.7.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-32232 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-32232 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-32232. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-32232 in your dependencies?
O3 Security finds CVE-2026-32232 across crates.io dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.