5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9q2p-vc84-2rwm

GHSA-9q2p-vc84-2rwm: OpenClaw: system.run allow-always persistence included shell-commented payload tails

OpenClaw's system.run allowlist analysis did not honor POSIX shell comment semantics when deriving allow-always persistence entries.

A caller in security=allowlist mode who received an allow-always decision could submit a shell command whose tail was commented out at runtime, for example by using an unquoted # before a chained payload. The runtime shell would execute only the pre-comment portion, but allowlist persistence could still analyze and store the non-executed tail as a trusted follow-up command.

Latest published npm version: 2026.3.2

Fixed on main on March 7, 2026 in 939b18475d734ed75173f59507e3ebbdfe1992b7 by teaching shell tokenization and chain/pipeline analysis to stop at unquoted shell comments, so allow-always persistence now tracks only commands that the shell can actually execute. Normal real chained commands and quoted # literals continue to work.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.2
Patched version: >= 2026.3.7

Fix Commit(s)

939b18475d734ed75173f59507e3ebbdfe1992b7

Release Process Note

npm 2026.3.7 was published on March 8, 2026. This advisory is fixed in the released package.

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9q2p-vc84-2rwm

GHSA-9q2p-vc84-2rwm:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.2	2026.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw's system.run stemmed from its failure to correctly interpret POSIX shell comment semantics (#). When a command was submitted in security=allowlist mode with an allow-always decision, the system would analyze the entire command string for persistence, even if parts of it were commented out and would not be executed by the shell. This created a loophole where an attacker could submit a command like legit-command # malicious-command. The shell would only execute legit-command, but the allowlist persistence mechanism would analyze and trust the entire string, including malicious-command. Subsequently, if malicious-command were to be executed directly, it would be permitted without further checks.

The patch addresses this by modifying three key functions involved in command parsing: splitShellPipeline, splitCommandChainWithOperators, and splitShellArgs. The fix introduces a new helper function, isShellCommentStart, to detect unquoted shell comments. The parsing logic in the vulnerable functions was updated to stop processing the command string upon encountering a comment. This ensures that only the executable parts of a command are considered for allow-always persistence, effectively closing the vulnerability.

Vulnerable functions

splitShellPipeline

src/infra/exec-approvals-analysis.ts

The `splitShellPipeline` function was vulnerable because it did not properly handle shell comments. It would continue to parse a command string even after a '#' character, leading to the persistence of commands in the `allow-always` list that would never be executed by the shell. An attacker could craft a command with a benign first part and a malicious second part commented out. The system would trust the entire line, allowing the malicious part to be executed later without approval.

splitCommandChainWithOperators

src/infra/exec-approvals-analysis.ts

Similar to `splitShellPipeline`, the `splitCommandChainWithOperators` function was vulnerable because it failed to recognize shell comments. This allowed it to parse and trust chained commands that were commented out and would not be executed by the shell. This could lead to the same `allow-always` persistence bypass where a malicious command is trusted because it was part of a seemingly benign, but commented, command chain.

splitShellArgs

src/utils/shell-argv.ts

The `splitShellArgs` function is responsible for splitting a raw command string into an array of arguments. The vulnerability existed because this function did not treat the '#' character as the start of a comment, and would therefore include the commented-out portion of the command as arguments. This incorrect parsing contributed to the broader vulnerability of persisting non-executable commands.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.