PT-2026-27293 · Npm · Openclaw

Published 2026-03-13 · Updated 2026-03-13

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

matchesExecAllowlistPattern normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the ? wildcard could match /, which allowed matches to cross path segments.

Impact

These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.

Affected versions

openclaw <= 2026.3.8

Patch

Fixed in openclaw 2026.3.11 and included in later releases such as 2026.3.12. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.

Fix

Weakness Enumeration

CWE-625

CWE-178

Related Identifiers

GHSA-F8R2-VG7X-GH8M

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-f8r2-vg7x-gh8m · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11 · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-f8r2-vg7x-gh8m · Note