PT-2026-6419 · Npm · Openclaw

Publicado 2026-02-04 · Atualizado 2026-02-04

OSV

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

An unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user.

Impact

A local process on the same machine could execute arbitrary commands as the gateway process user.

Details

• config.apply accepted raw JSON and wrote it to disk after schema validation.
• cliPath values were not constrained to safe executable names/paths.
• Command discovery used a shell invocation when resolving executables.

Mitigation

Upgrade to a patched release. If projects cannot upgrade immediately, set gateway.auth and avoid custom cliPath values.

Correção

Missing Authentication

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-306

CWE-78

CWE-20

Identificadores relacionados

GHSA-G55J-C2V4-PJCG

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg · Nota
• https://osv.dev/vulnerability/GHSA-g55j-c2v4-pjcg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25593 · Nota de Segurança