N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7ff8-xjh3-mgh6

GHSA-7ff8-xjh3-mgh6: OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt

Summary

In openclaw versions up to and including 2026.2.22-2, a non-default exec-approval configuration could allow a skill-name collision to bypass an ask=on-miss prompt.

When autoAllowSkills=true, a path-scoped executable such as ./skill-bin could resolve to basename skill-bin, satisfy the skills allowlist segment, and run without prompting for approval.

Affected Packages / Versions

Package: npm openclaw
Affected versions: <= 2026.2.22-2
Patched versions: >= 2026.2.23 (released)

Configuration Scope (Not Default)

This behavior requires non-default settings and does not affect default installs.

Required conditions:

autoAllowSkills=true (default is false)
system.run with security=allowlist
ask=on-miss

Technical Details

The allowlist evaluator accepted skills satisfaction by bin-name match, so ./skill-bin could match skillBins.has("skill-bin") after resolution.

The fix hardens skill auto-allow matching by requiring:

a pathless invocation token (no / or \\), and
a trusted resolved executable path for that skill bin on the machine where skills run.

This preserves normal skill-bin ... behavior while preventing ./<skill-bin> and absolute-path basename collisions from auto-satisfying skills.

Impact

In affected non-default configurations, approval prompts could be skipped for commands that should have required operator confirmation.

Fix Commit(s)

ffd63b7a2c4c6d5aeb4710ef951d5794ad7ad77b (fix(security): trust resolved skill-bin paths in allowlist auto-allow)

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7ff8-xjh3-mgh6

GHSA-7ff8-xjh3-mgh6:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.22-2	2026.2.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the mechanism for auto-approving commands that are classified as 'skills' in non-default OpenClaw configurations where autoAllowSkills is enabled. The core of the issue was in the evaluateSegments function, which was responsible for checking if a command segment should be allowed to run without a prompt.

The original logic incorrectly identified a skill based on its basename. This meant that if a skill named skill-bin was on the allowlist, an attacker could create a malicious executable with the same name (skill-bin) in the current working directory and execute it as ./skill-bin. The approval logic would resolve ./skill-bin to the basename skill-bin, match it against the trusted skill list, and incorrectly grant it execution privileges without prompting the user.

The patch addresses this by introducing a more robust verification process. The new isSkillAutoAllowedSegment function now requires two conditions to be met for a skill to be auto-allowed:

The command invocation must be pathless (i.e., it cannot contain / or \).
The resolved absolute path of the executable must match a pre-registered, trusted path for that skill name.

This ensures that only legitimate, trusted skills can be executed without explicit approval, effectively preventing the path-based impersonation attack. The handleSystemRunInvoke function is the entry point for this entire workflow and would be observed in any runtime profile of the exploit.

Vulnerable functions

evaluateSegments

src/infra/exec-approvals-allowlist.ts

This function contained the flawed logic for auto-allowing skills. The original implementation checked if a command was a skill based on its basename (`executableName`), without properly validating that the invocation was pathless. This allowed a path-scoped command like `./skill-bin` to be treated as the trusted skill `skill-bin`, bypassing the intended security prompt. The patch replaces this vulnerable logic with a call to the new `isSkillAutoAllowedSegment` function, which enforces stricter checks.

handleSystemRunInvoke

src/node-host/invoke-system-run.ts

This function is the high-level orchestrator for executing system commands. It is responsible for gathering the necessary context, including the list of trusted skills, and then calling the allowlist evaluation logic (`evaluateSystemRunAllowlist`). During an exploit, this function would be on the stack trace as it initiates the process that leads to the vulnerable `evaluateSegments` function being called. The patch modifies this function to handle the new trusted skill data structure (`SkillBinTrustEntry[]`).

evaluateExecAllowlist

src/infra/exec-approvals-allowlist.ts

This function is an entry point for the vulnerable logic, which directly calls `evaluateSegments`. It is responsible for evaluating whether a parsed command is permitted by the allowlist. An attacker exploiting the vulnerability would cause this function to be called as part of the command execution flow.

evaluateShellAllowlist

src/infra/exec-approvals-allowlist.ts

Similar to `evaluateExecAllowlist`, this function serves as another entry point to the vulnerable logic in `evaluateSegments`, but specifically for shell commands. It analyzes a raw shell command string and determines if it's permitted. This function would also appear in a runtime profile when the vulnerability is triggered via a shell command.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-7ff8-xjh3-mgh6: OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt

Summary

Affected Packages / Versions

Configuration Scope (Not Default)

Technical Details

Impact

Fix Commit(s)

GHSA-7ff8-xjh3-mgh6:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

GHSA-7ff8-xjh3-mgh6: OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt

Summary

Affected Packages / Versions

Configuration Scope (Not Default)

Technical Details

Impact

Fix Commit(s)

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI