PT-2026-27293 · Npm · Openclaw

Publicado 2026-03-13 · Atualizado 2026-03-13

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

matchesExecAllowlistPattern normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the ? wildcard could match /, which allowed matches to cross path segments.

Impact

These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.

Affected versions

openclaw <= 2026.3.8

Patch

Fixed in openclaw 2026.3.11 and included in later releases such as 2026.3.12. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.

Correção

Enumeração de Fraquezas

CWE-625

CWE-178

Identificadores relacionados

GHSA-F8R2-VG7X-GH8M

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11 · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-f8r2-vg7x-gh8m · Nota
• https://osv.dev/vulnerability/GHSA-f8r2-vg7x-gh8m · Aviso do Fabricante