Количество 3
Количество 3
CVE-2026-29610
OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables through node-host execution or project-local bootstrapping. Attackers with authenticated access to node-host execution surfaces or those running OpenClaw in attacker-controlled directories can place malicious executables in PATH to override allowlisted safe-bin commands and achieve arbitrary command execution.
GHSA-jqpq-mgvm-f9r6
OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)
BDU:2026-06350
Уязвимость команды system.run ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольные команды
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-29610 OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables through node-host execution or project-local bootstrapping. Attackers with authenticated access to node-host execution surfaces or those running OpenClaw in attacker-controlled directories can place malicious executables in PATH to override allowlisted safe-bin commands and achieve arbitrary command execution. | CVSS3: 8.8 | 0% Низкий | 5 месяцев назад |
| GHSA-jqpq-mgvm-f9r6 OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides) | CVSS3: 8.8 | 0% Низкий | 6 месяцев назад |
 | BDU:2026-06350 Уязвимость команды system.run ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольные команды | CVSS3: 8.8 | 0% Низкий | 6 месяцев назад |
Уязвимостей на страницу