TeX Render

• Analyzed: May 12, 2026, 4:07 AM
• Findings: 1
• Version: 1.1.4
• Hash: 9f4596aa9d6f79ec82fb59d996762316efdfbe20e7874a3c58259739aa596ab5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/render.js` file contains a path traversal vulnerability. The `output_base_path` argument, if controlled by an attacker, can be used to write files to arbitrary locations on the filesystem outside the intended `~/.openclaw/media/tex-render/` directory. While there is no explicit malicious intent (e.g., data exfiltration, persistence) within the provided code or agent instructions (`SKILL.md`), this vulnerability allows for potential arbitrary file writes, which is a significant security flaw.