N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-796m-2973-wc5q

GHSA-796m-2973-wc5q: OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

Summary

tools.exec allowlist/safe-bins evaluation could diverge from runtime execution for wrapper commands using GNU env -S/--split-string semantics. This allowed policy checks to treat a command as a benign safe-bin invocation while runtime executed a different payload.

Affected Packages / Versions

Package: openclaw (npm)
Vulnerable versions: <= 2026.2.22-2 (latest currently published npm version)
Patched version (released): 2026.2.23

Impact

An attacker able to influence tool command text (for example via untrusted prompt/content injection reaching an exec-capable flow) could bypass allowlist/safe-bins intent and execute unexpected commands.

Technical Details

Root cause was policy/runtime interpretation mismatch for dispatch wrappers:

analysis resolved an effective executable from wrapper-unwrapped argv,
execution could still run original wrapper argv semantics,
safe-bin short-flag handling also allowed unknown short options in clusters.

Remediation

The fix hardens exec approvals to fail closed and enforce analysis/runtime parity:

introduce wrapper execution planning with semantic-wrapper blocking,
carry planned effectiveArgv + policyBlocked metadata through resolution,
evaluate allowlist/safe-bins against planned argv,
enforce canonical rebuilt shell command from planned argv for allowlist auto-paths,
use planned argv for node-host/mac exec-host invocation paths,
reject unknown short safe-bin flags,
add regression tests for semantic env wrappers and parity fixtures.

Fix Commit(s)

a1c4bf07c6baad3ef87a0e710fe9aef127b1f606

Release Process Note

patched_versions is pre-set to the released version (2026.2.23). Patched in 2026.2.23 and published.

OpenClaw thanks @jiseoung for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-796m-2973-wc5q

GHSA-796m-2973-wc5q:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.23	2026.2.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-796m-2973-wc5q, is a policy-runtime interpretation mismatch in OpenClaw's tools.exec functionality. The root cause is a discrepancy between how a command is analyzed for security policy compliance (allowlist/safe-bins) and how it is actually executed by the system. This is particularly abusable with command wrappers like GNU env when used with the -S (--split-string) option, which alters how the command line is parsed.

The analysis phase, in functions like unwrapDispatchWrappersForResolution and resolveCommandResolutionFromArgv, would attempt to 'unwrap' the command to identify the core executable for checking against the allowlist. This unwrapping was flawed, as it would present a seemingly benign command for approval (e.g., tr) while ignoring the env -S wrapper that would cause the shell to execute a completely different command provided within the arguments.

Functions responsible for execution, such as handleSystemRunInvoke (for the node host) and processGatewayAllowlist (for the gateway), would then execute the original, user-supplied command. Because the security check was performed on a different interpretation of the command, a malicious command could bypass the allowlist and achieve arbitrary code execution.

The patch rectifies this by introducing a unified 'execution plan'. The analysis phase is hardened to recognize and 'fail closed' on such semantic-modifying wrapper usage by flagging them as policyBlocked. The execution functions are modified to strictly adhere to this plan, using an enforcedCommand or plannedAllowlistArgv derived directly from the analysis. This ensures that the command that gets executed is the exact same one that was analyzed and approved, closing the interpretation gap.

Vulnerable functions

processGatewayAllowlist

src/agents/bash-tools.exec-host-gateway.ts

The `processGatewayAllowlist` function was responsible for checking commands against the allowlist for the gateway execution host. The vulnerable version contained complex logic to build a supposedly 'safe' command using `buildSafeBinsShellCommand`. This logic did not account for the interpretation mismatch of command wrappers like `env -S`, allowing the execution of a command different from the one that was validated against the allowlist.

evaluateShellAllowlist

src/infra/exec-approvals-allowlist.ts

This function evaluates if a given shell command complies with the configured allowlist. The vulnerability lies in its internal helper `evaluateSegments`, which checked the original `segment.argv` against the `safeBins` policy. It did not use the `effectiveArgv` from the command analysis, nor did it check for a `policyBlocked` status. This allowed a command to pass the allowlist check based on a benign interpretation, while the actual execution could be malicious due to wrapper command semantics.

resolveCommandResolutionFromArgv

src/infra/exec-command-resolution.ts

This function resolves command details from an argument vector (`argv`). The vulnerable version used `unwrapDispatchWrappersForResolution` which incorrectly unwrapped commands, leading to a discrepancy between the analyzed command and the one that would be executed. The function did not have a mechanism to flag and block commands that used semantic-modifying wrappers like `env -S`, which is the root cause of the bypass.

unwrapDispatchWrappersForResolution

src/infra/exec-wrapper-resolution.ts

This function was at the core of the vulnerability. Its purpose was to 'unwrap' dispatch wrappers like `env` to find the effective command to be analyzed. However, its logic was too simplistic and would incorrectly strip the wrapper, presenting a benign command for policy analysis while the original command with dangerous wrapper arguments (e.g., `env -S`) would be executed. The patch replaces this logic entirely to use a new 'execution plan' that can identify and block such patterns.

handleSystemRunInvoke

src/node-host/invoke-system-run.ts

This function handles the invocation of system commands on the node host. Before the patch, it would execute the original `argv` from the user. The vulnerability was that the security approval (allowlist check) could have been performed on a different, 'unwrapped' version of the command. The patch introduces `plannedAllowlistArgv`, which comes from the analysis phase, to ensure the executed command is the same one that was approved.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-796m-2973-wc5q: OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

Summary

Affected Packages / Versions

Impact

Technical Details

Remediation

Fix Commit(s)

Release Process Note

GHSA-796m-2973-wc5q:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-796m-2973-wc5q: OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

Summary

Affected Packages / Versions

Impact

Technical Details

Remediation

Fix Commit(s)

Release Process Note

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI