N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-ff98-w8hj-qrxf

GHSA-ff98-w8hj-qrxf: OpenClaw plugin runtime command execution is part of trusted plugin boundary

Summary

OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (runtime.system.runCommandWithTimeout).

Impact

Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary.

Affected Packages / Versions

Package: openclaw (npm)
Latest published version reviewed: 2026.2.17
Affected range for this advisory record: <= 2026.2.17
Planned patched version metadata: 2026.2.19 (next release line)

Fix Commit(s)

2e421f32dfc589c02706265fd3c3137ffc06c4b1

Remediation

Install only trusted plugins.
Use plugins.allow to pin explicit trusted plugin IDs.
SECURITY.md now explicitly documents that plugin runtime helpers are convenience APIs, not a sandbox boundary.

OpenClaw thanks @markmusson for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-ff98-w8hj-qrxf

GHSA-ff98-w8hj-qrxf:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.19	2026.2.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory GHSA-ff98-w8hj-qrxf is not about a typical vulnerability but a clarification of the security model regarding OpenClaw plugins. The associated commit 2e421f32dfc589c02706265fd3c3137ffc06c4b1 reverts a previous security hardening measure that disabled OS command execution from plugins by default.

The analysis of the patch shows that the createPluginRuntime function in src/plugins/runtime/index.ts was modified to remove a protective wrapper (runtimeCommandExecutionGuarded) around the runCommandWithTimeout function. Previously, this wrapper would prevent runCommandWithTimeout from being called unless a specific configuration, plugins.runtime.allowLegacyExec, was set to true.

By removing this guard, the runCommandWithTimeout function, which allows the execution of arbitrary OS commands, is now directly exposed to any installed plugin by default. While the advisory frames this as a trust boundary clarification—placing the onus on users to only install trusted plugins—it means that a malicious plugin can trivially gain code execution on the host system by calling runtime.system.runCommandWithTimeout. The runCommandWithTimeout function would be the primary indicator in a runtime profile during such an exploitation event.

Vulnerable functions

createPluginRuntime

src/plugins/runtime/index.ts

This function creates the runtime environment for plugins. The patch removes the 'runtimeCommandExecutionGuarded' guard and directly exposes 'runCommandWithTimeout', which allows plugins to execute arbitrary OS commands. This change makes command execution available to plugins by default, whereas it was previously disabled.

runCommandWithTimeout

src/plugins/runtime/index.ts

This function is exposed to plugins and allows them to execute system commands. The vulnerability advisory clarifies that plugins are trusted, and this patch makes the function available by default. A malicious or compromised plugin could use this function to execute arbitrary commands on the host system.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.