5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-r6qf-8968-wj9q

GHSA-r6qf-8968-wj9q: OpenClaw: system.run wrapper-depth boundary could skip shell approval gating

OpenClaw's system.run dispatch-wrapper handling applied different depth-boundary rules to shell-wrapper approval detection and execution planning.

With exactly four transparent dispatch wrappers such as repeated env invocations before /bin/sh -c, the approval classifier could stop treating the command as a shell wrapper at the depth boundary while execution planning still unwrapped through to the shell payload. In security=allowlist mode, that mismatch could skip the expected approval-required path for the shell wrapper invocation.

Latest published npm version: 2026.3.2

Fixed on main on March 7, 2026 in 2fc95a7cfc1eb9306356510b0251b6d51fb1c0b0 by keeping shell-wrapper classification active at the configured dispatch depth boundary and only failing closed beyond that boundary. This aligns approval gating with the execution plan. Legitimate shallow dispatch-wrapper usage continues to work.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.2
Patched version: >= 2026.3.7

Fix Commit(s)

2fc95a7cfc1eb9306356510b0251b6d51fb1c0b0

Release Process Note

npm 2026.3.7 was published on March 8, 2026. This advisory is fixed in the released package.

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-r6qf-8968-wj9q

GHSA-r6qf-8968-wj9q:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.2	2026.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw's system.run functionality was due to a discrepancy in how dispatch wrapper depth boundaries were handled between the security approval and execution planning stages. Specifically, two internal functions, hasEnvManipulationBeforeShellWrapperInternal and extractShellWrapperCommandInternal, had inconsistent boundary checks.

The hasEnvManipulationBeforeShellWrapperInternal function, used for approval classification, would stop processing at the depth boundary (depth >= MAX_DISPATCH_WRAPPER_DEPTH), incorrectly concluding that a command was not a shell wrapper requiring approval. In contrast, the execution logic, including extractShellWrapperCommandInternal, would continue to unwrap the command at that same depth, leading to the execution of a shell command that should have been gated by the approval mechanism.

The patch corrects this by changing the boundary check from >= to > in both functions. This ensures that the command at the depth boundary is correctly classified as a shell wrapper and subjected to the necessary security approvals, aligning the behavior of the approval and execution paths.

Vulnerable functions

hasEnvManipulationBeforeShellWrapperInternal

src/infra/exec-wrapper-resolution.ts

This function was responsible for detecting if a command was a shell wrapper that required security approval. The original code used a `>=` comparison, which caused the check to incorrectly fail at the maximum dispatch wrapper depth. This allowed a command with a specific number of `env` wrappers to bypass the approval process, as the approval detection logic would stop one step earlier than the execution logic.

extractShellWrapperCommandInternal

src/infra/exec-wrapper-resolution.ts

This function is part of the execution planning and is responsible for extracting the command to be executed from a potential wrapper. The vulnerability was caused by a mismatch between this function's logic and the `hasEnvManipulationBeforeShellWrapperInternal` function. While this function would correctly unwrap the command at the depth boundary, the approval check would have already incorrectly decided that no approval was needed. The patch aligns the boundary checks of both functions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.