PT-2026-32074 · Npm · Openclaw

Published 2026-03-31 · Updated 2026-03-31

OSV

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

The jq safe-bin policy blocked explicit env usage but still allowed jq programs that accessed environment data through $ENV.

Impact

An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.

Affected Component

src/infra/exec-safe-bin-semantics.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 78e2f3d66d (Exec: tighten jq safe-bin env checks).

Thanks @nicky-cc of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-185

Related Identifiers

GHSA-JCCR-RRW2-VC8H

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-jccr-rrw2-vc8h · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-jccr-rrw2-vc8h · Note
• https://github.com/openclaw/openclaw/commit/78e2f3d66d74e5c7e6f45c54162e63986e39771b · Note