Количество 3
Количество 3
CVE-2026-22217
OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL variable. An attacker can influence the $SHELL environment variable on systems with writable trusted-prefix directories such as /opt/homebrew/bin to execute arbitrary binaries in the OpenClaw process context.
GHSA-p4wh-cr8m-gm6c
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
BDU:2026-05249
Уязвимость пакета shell-env ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-22217 OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL variable. An attacker can influence the $SHELL environment variable on systems with writable trusted-prefix directories such as /opt/homebrew/bin to execute arbitrary binaries in the OpenClaw process context. | CVSS3: 6.1 | 0% Низкий | 5 месяцев назад |
| GHSA-p4wh-cr8m-gm6c OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL | CVSS3: 6.1 | 0% Низкий | 5 месяцев назад |
 | BDU:2026-05249 Уязвимость пакета shell-env ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольный код | CVSS3: 6.1 | 0% Низкий | 6 месяцев назад |
Уязвимостей на страницу