3.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4685-c5cp-vp95

GHSA-4685-c5cp-vp95: OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

Summary

tools.exec.safeBins could be bypassed for filesystem access when sort output flags (-o / --output) or recursive grep flags were allowed through safe-bin execution paths.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.17
Patched versions: >= 2026.2.18
Latest published version at triage time: 2026.2.17

Impact

In deployments that enabled tools.exec.safeBins, an attacker with access to command execution flows could turn intended stdin-only safe-bin usage into file writes (sort -o) or recursive file reads (grep -R).

Fix Commit(s)

cfe8457a0f067c89cb8f0a3684f619bc2b73d680

Found using MCPwner

Thanks @nedlir for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4685-c5cp-vp95

GHSA-4685-c5cp-vp95:

3.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.17	2026.2.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-4685-c5cp-vp95, is a bypass of the safeBins execution protection in OpenClaw. The safeBins feature is intended to allow only a limited set of command-line tools to run with input from stdin, preventing them from accessing the filesystem. The root cause of the vulnerability was an incomplete implementation of the isSafeBinUsage function in src/infra/exec-approvals-allowlist.ts. This function was responsible for validating whether a command was safe to execute.

The analysis of the patch cfe8457a0f4aae5324daec261d3b0aad1461a4bc reveals that the isSafeBinUsage function did not check for specific command-line flags that could escalate the privileges of the executed command. For example, the sort command could be executed with the -o or --output flag to write to an arbitrary file, and the grep command could be used with recursive flags (-r, -R) to read files from the filesystem.

The patch addresses this by introducing a new function, hasBlockedSafeBinOption, which checks the arguments of a command against a blocklist of dangerous flags for each safe binary. This new check is integrated into the isSafeBinUsage function, effectively closing the bypass. The patch also removes sort and grep from the default list of safe binaries as an additional hardening measure. Therefore, the isSafeBinUsage function is the primary vulnerable function, as it contained the flawed logic that permitted the bypass.

Vulnerable functions

isSafeBinUsage

src/infra/exec-approvals-allowlist.ts

The function `isSafeBinUsage` was vulnerable because it did not properly validate the arguments passed to binaries considered 'safe'. Specifically, it failed to block flags for `sort` (`-o`, `--output`) and `grep` (`-r`, `-R`, etc.) that allow writing to arbitrary files or reading files recursively. This allowed an attacker to bypass the intended stdin-only restriction of `safeBins` and perform unauthorized file system operations.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.6

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-4685-c5cp-vp95: OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

Summary

Affected Packages / Versions

Impact

Fix Commit(s)

GHSA-4685-c5cp-vp95:

3.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-4685-c5cp-vp95: OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

Summary

Affected Packages / Versions

Impact

Fix Commit(s)

3.6

3.6

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI