Описание
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
Summary
system.run exec allowlist analysis treated wrapper binaries as the effective executable and did not fully unwrap env/shell-dispatch wrappers.
This allowed wrapper-smuggled payloads (for example env bash -lc ...) to satisfy an allowlist entry for the wrapper while executing non-allowlisted commands.
Impact
On affected versions, an actor who can trigger system.run requests under an allowlist policy could bypass intended allowlist restrictions by routing execution through wrapper binaries.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.21-2 - Patched in next release:
2026.2.22(pre-set below so publish can happen immediately after npm release)
Fix Commit(s)
2b63592be57782c8946e521bc81286933f0f99c7
Release Process Note
patched_versions is pre-set to the planned next release (>= 2026.2.22).
After npm 2026.2.22 is published, this advisory can be published directly without further metadata edits.
OpenClaw thanks @tdjackey for reporting.
Ссылки
- https://github.com/openclaw/openclaw/security/advisories/GHSA-jj82-76v6-933r
- https://nvd.nist.gov/vuln/detail/CVE-2026-27566
- https://github.com/openclaw/openclaw/commit/2b63592be57782c8946e521bc81286933f0f99c7
- https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-wrapper-binary-unwrapping-in-system-run
Пакеты
openclaw
< 2026.2.22
2026.2.22
Связанные уязвимости
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while executing non-allowlisted commands.
Уязвимость ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), связанная с непринятием мер по нейтрализации специальных элементов, позволяющая нарушителю выполнить произвольные команды