PT-2026-26236 · Openclaw · Openclaw

Nedlir · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-31996

NVD

CVSS v3.1

7.1

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesystem operations through sort output flags or recursive grep flags. Attackers with command execution access can leverage sort -o flag for arbitrary file writes or grep -R flag for recursive file reads, circumventing intended stdin-only restrictions.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-31996

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/commit/2c05cbb43e48ebad03626d3125746fb1b9a8520f · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4685-c5cp-vp95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31996 · Security Note
• https://twitter.com/VulmonFeeds/status/2034501117724205318 · Twitter Post
• https://vulncheck.com/advisories/openclaw-safebins-stdin-only-bypass-via-sort-output-and-recursive-grep-flags · Note
• https://twitter.com/cyberbivash/status/2034467578173591619 · Twitter Post
• https://twitter.com/CVEnew/status/2034520388743430297 · Twitter Post