6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-h3rm-6x7g-882f

GHSA-h3rm-6x7g-882f: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

Summary

In openclaw@2026.3.1, node system.run approval-path hardening rewrote wrapper command argv in a way that changed execution semantics. A command shown/approved as a shell payload (for example echo SAFE) could execute a different local script when wrapper argv were rewritten.

Affected Packages / Versions

Package: openclaw (npm)
Affected: 2026.3.1 (latest published npm version as of March 2, 2026)
Fixed release: 2026.3.2 (released)

Technical Details

Root cause was in node-host approval hardening for system.run:

src/node-host/invoke-system-run-plan.ts rewrote argv[0] to the resolved executable.
Wrapper resolution unwrapped dispatch wrappers, so input like ['env','sh','-c','echo SAFE'] resolved executable sh.
The approved plan could become ['/bin/sh','sh','-c','echo SAFE'] while approval text remained echo SAFE.

That rewrite changed runtime behavior: /bin/sh interprets the extra sh positional argument as a script path, enabling execution of a local ./sh file from approved cwd instead of the approved payload text.

Impact

Approval-integrity break in host=node execution flow: operator-visible command text and executed behavior could diverge.

Exploit preconditions:

attacker can influence wrapper argv and place a local file in approved working directory,
operator grants approval for the displayed command.

Fix Commit(s)

dded569626b0d8e7bdab10b5e7528b6caf73a0f1

Fixed Version

Patched in openclaw@2026.3.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-h3rm-6x7g-882f

GHSA-h3rm-6x7g-882f:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	= 2026.3.1	2026.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the hardenApprovedExecutionPaths function within src/node-host/invoke-system-run-plan.ts. This function incorrectly rewrote the argv (argument vector) of commands that used wrappers like env or sh -c. Specifically, it would resolve the main executable (e.g., sh) to its full path (e.g., /bin/sh) and prepend it to the argument list, while keeping the original arguments. For a command like ['env', 'sh', '-c', 'echo SAFE'], this would transform it into ['/bin/sh', 'sh', '-c', 'echo SAFE']. When executed, the shell (/bin/sh) would interpret its second argument (sh) as a local script file to run, instead of as its own name (argv[0]). This allowed an attacker who could place a file named sh in the working directory to execute arbitrary code, even if the operator approved a seemingly safe command.

The patch addresses this by adding checks within hardenApprovedExecutionPaths to detect if the command is a shell command or involves a wrapper. If so, it skips the argv rewriting, preserving the original command's semantics and preventing the vulnerability. The functions buildSystemRunApprovalPlan and evaluateSystemRunPolicyPhase were also updated to pass the necessary shellCommand information to hardenApprovedExecutionPaths, making the fix effective in the broader execution flow.

Vulnerable functions

hardenApprovedExecutionPaths

src/node-host/invoke-system-run-plan.ts

This function was responsible for rewriting the command's argv array. Before the patch, it would resolve the executable (e.g., 'sh' to '/bin/sh') and replace the first element of the argv array with the resolved path. This changed the semantics of commands using wrappers like 'env', causing '/bin/sh' to interpret the original command name as a script file to execute, leading to arbitrary script execution.

buildSystemRunApprovalPlan

src/node-host/invoke-system-run-plan.ts

This function calls `hardenApprovedExecutionPaths` to create an execution plan for approval. It was vulnerable because it did not pass the `shellCommand` information, leading `hardenApprovedExecutionPaths` to incorrectly rewrite the argv for shell-based commands.

evaluateSystemRunPolicyPhase

src/node-host/invoke-system-run.ts

This function is part of the execution flow and calls `hardenApprovedExecutionPaths` before running a command. It was vulnerable as it failed to provide the `shellCommand` context, thus allowing the dangerous argv rewriting to occur during policy evaluation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-h3rm-6x7g-882f: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

Summary

Affected Packages / Versions

Technical Details

Impact

Fix Commit(s)

Fixed Version

GHSA-h3rm-6x7g-882f:

6.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

6.7

6.7

GHSA-h3rm-6x7g-882f: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

Summary

Affected Packages / Versions

Technical Details

Impact

Fix Commit(s)

Fixed Version

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI