5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xvhf-x56f-2hpp

GHSA-xvhf-x56f-2hpp: OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion

Summary

OpenClaw's exec-approvals allowlist supports a small set of "safe bins" intended to be stdin-only (no positional file arguments) when running tools.exec.host=gateway|node with security=allowlist.

In affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (sh -c) which expands globs and environment variables. This allowed safe bins like head, tail, or grep to read arbitrary local files via tokens such as * or $HOME/... without triggering approvals.

This issue is configuration-dependent and is not exercised by default settings (default tools.exec.host is sandbox).

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.13
Patched: >= 2026.2.14 (planned; publish the advisory after the npm release is out)

Impact

An authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode.

Fix

Safe-bins executions now force argv tokens to be treated as literal text at execution time (single-quoted), preventing globbing and $VARS expansion from turning "safe" tokens into file paths.

Fix Commit(s)

77b89719d5b7e271f48b6f49e334a8b991468c3b

Release Process Note

patched_versions is pre-set for the next planned release (>= 2026.2.14) so publishing is a single click once that npm version is available.

Thanks @christos-eth for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-xvhf-x56f-2hpp

GHSA-xvhf-x56f-2hpp:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in OpenClaw's 'exec' tool, specifically when security=allowlist is enabled. The tool has a feature called 'safeBins' for commands that are presumed safe because they are meant to operate only on standard input. The core of the issue is a discrepancy between command validation and execution. The application would validate the command arguments before shell expansion, but then execute the command using a shell (sh -c) which performs expansion. This allowed an attacker to craft a command with shell metacharacters (e.g., * or $VAR) as arguments to a 'safeBin' like head or grep. The validation would pass, but at execution time, the shell would expand these characters into file paths, causing the 'safeBin' to read and output the contents of arbitrary files accessible to the process. The createExecTool function contained the logic that failed to sanitize the command for 'safeBin' executions, and runExecProcess was the function that directly executed the unsanitized command, leading to the vulnerability. The fix involves properly quoting each argument in the command string to prevent the shell from performing any expansion.

Vulnerable functions

createExecTool

src/agents/bash-tools.exec.ts

This function is the entry point for the `exec` tool. It contained the flawed logic that allowed an unsanitized command to be passed for execution when using a 'safeBin' in allowlist mode. This function would be on the stack trace during an exploit as it orchestrates the command execution.

runExecProcess

src/agents/bash-tools.exec-runtime.ts

This function is responsible for spawning the process to execute the command. It was vulnerable because it used a shell (`sh -c`) to execute the raw command string, which performs shell expansion on arguments. This allowed an attacker to bypass the 'safeBin' restrictions by using globbing or variable expansion to read local files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-xvhf-x56f-2hpp: OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion

Summary

Affected Packages / Versions

Impact

Fix

Fix Commit(s)

Release Process Note

GHSA-xvhf-x56f-2hpp:

5.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5.7

5.7

Basic Information

Basic Information

GHSA-xvhf-x56f-2hpp: OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion

Summary

Affected Packages / Versions

Impact

Fix

Fix Commit(s)

Release Process Note

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI