Skip to content
Fencer Intel
low —

GHSA-8mf7-vv8w-hjr2 json

OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

published 8mo ago modified 8mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute inline payloads via flags like `-c`.

This requires explicit operator configuration to add such binaries to `safeBins`, so impact is limited to non-default/misconfigured deployments.

### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` - Patched in code: `>= 2026.2.22` (planned next npm release)

### Fix - Remove generic safe-bin fallback during allowlist evaluation. - Require explicit safe-bin profiles for `safeBins` entries. - Add configurable `tools.exec.safeBinProfiles` (global + per-agent) for safe custom binaries. - Update docs to clearly separate `safeBins` from command allowlist semantics.

### Fix Commit(s) - `47c3f742b6c488be26dd7b9636dbbb8676089154`

### Release Process Note `patched_versions` is pre-set to the planned next release (`>= 2026.2.22`) so once that npm release is published, the advisory can be published directly without further metadata edits.

OpenClaw thanks @tdjackey for reporting.

Patch / fix

  • npm openclaw 2026.2.22

Is GHSA-8mf7-vv8w-hjr2 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm openclaw
<2026.2.22
2026.2.22

Classification

Weakness
  • CWE-693 Protection Mechanism Failure
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of openclaw/openclaw published their own advisory on GitHub. Reviewed sources take precedence over it.