N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5gj7-jf77-q2q2

GHSA-5gj7-jf77-q2q2: OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

Summary

In openclaw<=2026.2.23, safe-bin trust in allowlist mode relied on static default trusted directories that included package-manager paths (notably /opt/homebrew/bin and /usr/local/bin). When a same-name binary (for example jq) is placed in one of those trusted default directories, safe-bin evaluation can be satisfied and execute the attacker-controlled binary.

Impact

This is an exec allowlist safeBins policy bypass that can lead to command execution in the OpenClaw runtime context. Severity is set to Medium given the required ability to write into trusted host binary directories.

Affected Packages / Versions

Package: openclaw (npm)
Vulnerable versions: <= 2026.2.23
Patched versions: >= 2026.2.24 (planned next npm release)
Latest published npm version at triage time (2026-02-24): 2026.2.23

Root Cause

Default safe-bin trusted directories included package-manager/user-managed paths.
Trust decision was directory-membership only for resolved executable paths.

Remediation

Restrict default safe-bin trusted directories to immutable system paths: /bin, /usr/bin.
Require explicit operator opt-in for package-manager/user paths via tools.exec.safeBinTrustedDirs.

Fix Commit(s)

b67e600bff696ff2ed9b470826590c0ce6b3bb0a

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.24). Once npm release 2026.2.24 is published, this advisory should be ready for publish without additional version edits.

OpenClaw thanks @tdjackey for reporting.

Publication Update (2026-02-25)

openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5gj7-jf77-q2q2

GHSA-5gj7-jf77-q2q2:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.23	2026.2.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-5gj7-jf77-q2q2, exists in the openclaw package and pertains to an insecure default configuration for 'safe binaries'. The root cause is that the application trusted binaries located in user-writable directories like /opt/homebrew/bin and /usr/local/bin by default. An attacker could place a malicious executable with a commonly trusted name (like jq) in one of these locations, and openclaw would execute it, leading to a command injection.

The analysis of the provided patch b67e600bff696ff2ed9b470826590c0ce6b3bb0a reveals the exact location of the vulnerability. The file src/infra/exec-safe-bin-trust.ts contained a constant DEFAULT_SAFE_BIN_TRUSTED_DIRS which included these insecure paths. The patch remediates this by removing the user-writable paths, leaving only /bin and /usr/bin.

The function getTrustedSafeBinDirs in src/infra/exec-safe-bin-trust.ts is identified as a vulnerable function because it is responsible for reading and providing this insecure list of directories. Furthermore, the function resolveExecSafeBinRuntimePolicy from src/infra/exec-safe-bin-runtime-policy.ts is also identified as vulnerable because it consumes this insecure configuration to build the runtime security policy. The changes in the test files confirm that these functions were central to the vulnerability.

Vulnerable functions

getTrustedSafeBinDirs

src/infra/exec-safe-bin-trust.ts

This function is responsible for providing the list of default trusted directories for safe binaries. Before the patch, this list, defined by `DEFAULT_SAFE_BIN_TRUSTED_DIRS`, included user-writable directories such as `/opt/homebrew/bin` and `/usr/local/bin`. This allowed an attacker with write access to these directories to place a malicious binary with a trusted name (e.g., `jq`), leading to arbitrary code execution when the application attempts to use that safe binary.

resolveExecSafeBinRuntimePolicy

src/infra/exec-safe-bin-runtime-policy.ts

This function resolves the execution policy for safe binaries, which includes determining the set of trusted directories. It uses the insecure list of default directories provided by `getTrustedSafeBinDirs`. The updated test file for this function confirms that after the patch, it no longer trusts package manager binary directories by default. Therefore, this function was part of the vulnerable call chain that established the overly permissive security policy.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-5gj7-jf77-q2q2: OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

Summary

Impact

Affected Packages / Versions

Root Cause

Remediation

Fix Commit(s)

Release Process Note

Publication Update (2026-02-25)

GHSA-5gj7-jf77-q2q2:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

GHSA-5gj7-jf77-q2q2: OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

Summary

Impact

Affected Packages / Versions

Root Cause

Remediation

Fix Commit(s)

Release Process Note

Publication Update (2026-02-25)

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI