5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3h2q-j2v4-6w5r

GHSA-3h2q-j2v4-6w5r: OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers

OpenClaw's system.run shell-wrapper detection did not recognize PowerShell -EncodedCommand forms as inline-command wrappers.

In allowlist mode, a caller with access to system.run could invoke pwsh or powershell using -EncodedCommand, -enc, or -e, and the request would fall back to plain argv analysis instead of the normal shell-wrapper approval path. This could allow a PowerShell inline payload to execute without the approval step that equivalent -Command invocations would require.

Latest published npm version: 2026.3.2

Fixed on main on March 7, 2026 in 1d1757b16f48f1a93cd16ab0ad7e2c3c63ce727d by recognizing PowerShell encoded-command aliases during shell-wrapper parsing, so allowlist mode continues to require approval for those payloads. Normal approved PowerShell wrapper flows continue to work.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.2
Patched version: >= 2026.3.7

Fix Commit(s)

1d1757b16f48f1a93cd16ab0ad7e2c3c63ce727d

Release Process Note

npm 2026.3.7 was published on March 8, 2026. This advisory is fixed in the released package.

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3h2q-j2v4-6w5r

GHSA-3h2q-j2v4-6w5r:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.2	2026.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a bypass of the system.run allowlist approval mechanism in OpenClaw when using PowerShell's encoded command feature. The root cause is an incomplete list of PowerShell flags used to detect inline commands.

The analysis of the patch 1d1757b16f48f1a93cd16ab0ad7e2c3c63ce727d reveals that the file src/infra/shell-inline-command.ts was modified to expand the POWERSHELL_INLINE_COMMAND_FLAGS set. This set is used to identify PowerShell commands that execute inline scripts. The added flags are -encodedcommand, -enc, and -e.

The function resolveInlineCommandMatch in the same file is responsible for using these flags to determine if a command contains an inline script. Before the patch, this function would not recognize commands using the encoded command flags, causing the system to treat them as regular commands and skip the required security approval. This allowed for arbitrary code execution in environments where system.run was restricted.

The tests added in src/infra/system-run-command.test.ts and src/node-host/invoke-system-run.test.ts confirm this behavior and validate the fix. The primary vulnerable function is resolveInlineCommandMatch as it contains the flawed detection logic.

Vulnerable functions

resolveInlineCommandMatch

src/infra/shell-inline-command.ts

The vulnerability lies in the `resolveInlineCommandMatch` function, which is responsible for identifying inline shell commands that require security approval. Before the patch, this function used an incomplete set of flags (`POWERSHELL_INLINE_COMMAND_FLAGS`) to detect PowerShell inline commands. It missed the `-EncodedCommand`, `-enc`, and `-e` flags. This omission allowed an attacker to craft a PowerShell command using these flags to execute an encoded payload, bypassing the security approval mechanism. The patch rectifies this by adding the missing flags to `POWERSHELL_INLINE_COMMAND_FLAGS`, ensuring that such commands are correctly identified and subjected to the approval process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.