PT-2026-26236 · Openclaw · Openclaw

Nedlir · Publicado 2026-02-19 · Atualizado 2026-03-20 · CVE-2026-31996

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.19

Description The tools.exec.safeBins component contains an input validation bypass that allows attackers to execute unintended filesystem operations. Specifically, the issue arises when using sort output flags (like -o or --output) or recursive grep flags. Attackers with command execution access can exploit this to perform arbitrary file writes using the sort -o flag or recursive file reads using the grep -R flag, bypassing the intended stdin-only restrictions. The affected component, tools.exec.safeBins, allows for filesystem access when these flags are enabled within safe-bin execution paths.

Recommendations Update to OpenClaw version 2026.2.19 or later.

Correção

Incomplete List of Disallowed Inputs

OS Command Injection

Enumeração de Fraquezas

CWE-184

CWE-78

Identificadores relacionados

BDU:2026-05007

CVE-2026-31996

GHSA-4685-C5CP-VP95

GHSA-GGM6-H3MX-CMMP

Produtos afetados

Openclaw

Referências · 15

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4685-c5cp-vp95 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/cfe8457a0f4aae5324daec261d3b0aad1461a4bc · Nota
• https://github.com/openclaw/openclaw/commit/2c05cbb43e48ebad03626d3125746fb1b9a8520f · Correção
• https://vulncheck.com/advisories/openclaw-safebins-stdin-only-bypass-via-sort-output-and-recursive-grep-flags · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-31996 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-05007 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ggm6-h3mx-cmmp · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2034467578173591619 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-31996 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4685-c5cp-vp95 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034501117724205318 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2034735878384320532 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2034880273142489393 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034520388743430297 · Publicação no Twitter