PT-2026-25123 · Npm · Openclaw
Publicado
2026-03-02
·
Atualizado
2026-03-02
CVSS v3.1
4.8
Média
| Vetor | AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N |
Summary
system.run approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw.Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.2.24 - Patched versions:
>= 2026.2.25
Impact
This is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence
command argv and reuse/obtain a matching approval context.Trust Model Note
OpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv).
Fix Commit(s)
03e689fc89bbecbcd02876a95957ef1ad9caa176
Release Process Note
patched versions is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.OpenClaw thanks @tdjackey for reporting.
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Openclaw