N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-w6wx-jq6j-6mcj

GHSA-w6wx-jq6j-6mcj: OpenClaw: pnpm dlx approvals did not bind local script operands

Summary

Before OpenClaw 2026.4.2, pnpm dlx approval planning did not bind local script operands the same way as related pnpm exec flows. A local script approved through a pnpm dlx path could be replaced before execution without invalidating the approval.

Impact

An operator could approve a benign local script and then execute modified script contents through the still-valid approval plan. This was an approval-integrity bug in the node-host command-planning path.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

176c059b05357df1bc09d4328a2380670859eeff — bind local scripts in pnpm dlx approval plans

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @Kazamayc for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-w6wx-jq6j-6mcj

GHSA-w6wx-jq6j-6mcj:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed an attacker to bypass an approval mechanism in OpenClaw when using pnpm dlx commands. An operator could approve a benign local script, but an attacker could modify the script's contents before execution without invalidating the approval. This was because the approval system did not correctly bind the approval to the script's content for pnpm dlx commands.

The root cause of this issue was located in the command parsing logic within the invoke-system-run-plan.ts file. The function unwrapPnpmExecInvocation was responsible for parsing pnpm commands but did not handle the dlx subcommand. Consequently, the higher-level function buildSystemRunApprovalPlan, which constructs the security approval plan, was not aware of the local script being executed and failed to create a content-based snapshot (mutableFileOperand) for it.

The patch addresses this by introducing logic within unwrapPnpmExecInvocation to specifically handle pnpm dlx commands, delegating the parsing to a new unwrapPnpmDlxInvocation function. This ensures that the local script is correctly identified, and its content is snapshotted as part of the approval plan, preventing any subsequent modifications from being executed under the original approval.

Vulnerable functions

buildSystemRunApprovalPlan

src/node-host/invoke-system-run-plan.ts

This function is responsible for creating the execution approval plan. It was vulnerable because it relied on underlying functions that did not correctly parse `pnpm dlx` commands. As a result, it failed to identify and bind the approval to the local script being executed, allowing the script to be modified after approval but before execution.

unwrapPnpmExecInvocation

src/node-host/invoke-system-run-plan.ts

This function parses `pnpm` command arguments to identify the command to be executed. Before the patch, it lacked the logic to handle the `dlx` subcommand. This caused the approval system to be unaware of the local script operand in `pnpm dlx` commands, leading to the approval bypass vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.