N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-wpc6-37g7-8q4w

GHSA-wpc6-37g7-8q4w: OpenClaw: Shell init-file options could satisfy exec allowlist script matching

Summary

Before OpenClaw 2026.3.31, exec allowlist matching could treat shell init-file wrapper invocations as if the approved script itself were being executed. Shell options such as --rcfile, --init-file, and --startup-file could therefore inherit allowlist trust from a matched script path even though the shell loaded attacker-chosen initialization first.

Impact

This issue only applied when exec allowlist or allow-always behavior was enabled and the attacker could steer a shell-wrapper command shape that used init-file options. The result was a narrower allowlist bypass, not generic arbitrary command execution from an untrusted boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.3.31
Patched versions: >= 2026.3.31
Latest published npm version: 2026.4.1

Fix Commit(s)

0c8375424620e12777ef24c162eedc7e9fcfd7e3 — reject shell init-file script matches

Release Process Note

The fix shipped in OpenClaw 2026.3.31 on March 31, 2026. The current published npm release 2026.4.1 from April 1, 2026 also contains the fix.

Thanks @cyjhhh for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-wpc6-37g7-8q4w

GHSA-wpc6-37g7-8q4w:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.3.31	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability allows for a bypass of the exec allowlist in OpenClaw. The root cause is the incomplete validation of shell command arguments. The provided patch commit 0c8375424620e12777ef24c162eedc7e9fcfd7e3 clearly points to the vulnerable logic. The file src/infra/exec-approvals-allowlist.ts contains the function resolveShellWrapperScriptCandidatePath, which is responsible for parsing and validating shell commands against an allowlist. Before the patch, this function did not account for shell options like --rcfile or --init-file, which instruct the shell to load and execute a specified file upon startup. An attacker could abuse this by crafting a command that references an allowlisted script but also includes a malicious init-file. The resolveShellWrapperScriptCandidatePath function would incorrectly validate the command based on the benign script path, while the underlying shell would execute the malicious init-file, leading to a bypass. The patch introduces a new function, hasDisqualifyingShellWrapperScriptOption, and integrates it into resolveShellWrapperScriptCandidatePath to explicitly check for and reject commands containing these dangerous options. Therefore, resolveShellWrapperScriptCandidatePath is the specific function that contained the vulnerability.

Vulnerable functions

resolveShellWrapperScriptCandidatePath

src/infra/exec-approvals-allowlist.ts

The vulnerability existed because the `resolveShellWrapperScriptCandidatePath` function did not properly inspect shell command arguments. It failed to identify and reject shell 'init-file' options such as `--rcfile`, `--init-file`, and `--startup-file`. An attacker could craft a command that included an allowlisted script, but also used one of these options to point to a malicious initialization file. The function would incorrectly approve the command based on the allowlisted script, but the shell would execute the attacker's malicious file first, bypassing the allowlist's security control. The patch fixes this by adding a check for these disqualifying options within this function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.