PT-2026-32074 · Npm · Openclaw

Publicado 2026-03-31 · Atualizado 2026-03-31

OSV

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

The jq safe-bin policy blocked explicit env usage but still allowed jq programs that accessed environment data through $ENV.

Impact

An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.

Affected Component

src/infra/exec-safe-bin-semantics.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 78e2f3d66d (Exec: tighten jq safe-bin env checks).

Thanks @nicky-cc of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-185

Identificadores relacionados

GHSA-JCCR-RRW2-VC8H

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-jccr-rrw2-vc8h · Nota
• https://github.com/openclaw/openclaw/commit/78e2f3d66d74e5c7e6f45c54162e63986e39771b · Nota
• https://osv.dev/vulnerability/GHSA-jccr-rrw2-vc8h · Aviso do Fabricante