GHSA-48wf-g7cp-gr3m CVE-2026-31992

OpenClaw has allowlist exec-guard bypass via env -S

High npm

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.34%; Chance of exploitation in the next 30 days. Higher than 28.04% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-184 Incomplete List of Disallowed Inputs; CWE-193 Off-by-one Error
Fix: 2026.2.23; Upgrade openclaw to this version or later

Description

Summary

In allowlist mode, system.run guardrails could be bypassed through env -S, causing policy-analysis/runtime-execution mismatch for shell wrapper payloads.

Severity Rationale (Medium)

This issue is rated medium because it is a guardrail/policy bypass in OpenClaw's trusted-operator model, not an authentication boundary break.

Authenticated Gateway callers are trusted operators by design.
exec approvals/allowlists are operator safety controls.
The bug still weakens expected safety behavior and can enable unintended command execution when untrusted content influences tool input.

Affected Packages / Versions

Package: openclaw (npm)
Vulnerable versions: <= 2026.2.22-2
Patched versions: >= 2026.2.23

Latest published npm version checked during triage: 2026.2.22-2.

Technical Impact

When /usr/bin/env is allowlisted, env -S 'sh -c ...' could be treated as allowed non-wrapper argv while runtime still executes shell-wrapper semantics.

Fix Commit(s)

a1c4bf07c6baad3ef87a0e710fe9aef127b1f606 (core allowlist/runtime parity hardening)
3f923e831364d83d0f23499ee49961de334cf58b (explicit env -S regressions)

Release Process Note

patched_versions is pre-set to >= 2026.2.23, so this advisory is now public.

OpenClaw thanks @tdjackey for reporting.

Affected versions

npm

Package	Vulnerable	Fixed in
openclaw	`< 2026.2.23`	`2026.2.23`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openclaw npm → `2026.2.23`

npm

npm install openclaw@2026.2.23

yarn

yarn add openclaw@2026.2.23

pnpm

pnpm add openclaw@2026.2.23

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): Low
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-184: Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

How to prevent it

Implementation: Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

CWE-193: Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

How to prevent it

Implementation: When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-31992

Packages

github.com/openclaw/openclaw

Timeline

Mar 3, 2026 Published
Jun 17, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-3x84-qq85-fj65 OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs	High	Also affects openclaw
GHSA-9c3v-684m-579c OpenClaw MCP SSE redirects could forward Authorization headers	Medium	Also affects openclaw
GHSA-f397-5vjw-v2c2 OpenClaw: Shell inline-command parsing could miss an allowlist check	High	Also affects openclaw
GHSA-rx78-29qr-5hq8 OpenClaw: Workspace-derived service PATH could influence trash command selection	High	Also affects openclaw
GHSA-ccwh-wwpp-6wg5 OpenClaw: Host environment sanitizer missed two Node.js control variables	High	Also affects openclaw
GHSA-985f-72mj-8gf7 OpenClaw: Tool group policy callers could accept unvalidated group IDs	Medium	Also affects openclaw
GHSA-9v8j-9c9g-w66c OpenClaw: Bootstrap token replay could widen pending pairing scopes	Medium	Also affects openclaw
GHSA-c226-q6fx-6j6c OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags	Medium	Also affects openclaw

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor