Skip to content
Fencer Intel
medium —

GHSA-ff98-w8hj-qrxf json

OpenClaw plugin runtime command execution is part of trusted plugin boundary

published 8mo ago modified 8mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`).

### Impact Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version reviewed: `2026.2.17` - Affected range for this advisory record: `<= 2026.2.17` - Planned patched version metadata: `2026.2.19` (next release line)

### Fix Commit(s) - `2e421f32dfc589c02706265fd3c3137ffc06c4b1`

### Remediation - Install only trusted plugins. - Use `plugins.allow` to pin explicit trusted plugin IDs. - SECURITY.md now explicitly documents that plugin runtime helpers are convenience APIs, not a sandbox boundary.

OpenClaw thanks @markmusson for reporting.

Patch / fix

  • npm openclaw 2026.2.19

Is GHSA-ff98-w8hj-qrxf in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm openclaw
<2026.2.19
2026.2.19

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of openclaw/openclaw published their own advisory on GitHub. Reviewed sources take precedence over it.