GHSA-9q2p-vc84-2rwm

Source

https://github.com/advisories/GHSA-9q2p-vc84-2rwm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9q2p-vc84-2rwm/GHSA-9q2p-vc84-2rwm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9q2p-vc84-2rwm

Downstream

MINI-cf8w-m9q7-2mcm

Published

2026-03-09T19:54:46Z

Modified

2026-03-09T20:01:23Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

OpenClaw: system.run allow-always persistence included shell-commented payload tails

Details

OpenClaw's system.run allowlist analysis did not honor POSIX shell comment semantics when deriving allow-always persistence entries.

A caller in security=allowlist mode who received an allow-always decision could submit a shell command whose tail was commented out at runtime, for example by using an unquoted # before a chained payload. The runtime shell would execute only the pre-comment portion, but allowlist persistence could still analyze and store the non-executed tail as a trusted follow-up command.

Latest published npm version: 2026.3.2

Fixed on main on March 7, 2026 in 939b18475d734ed75173f59507e3ebbdfe1992b7 by teaching shell tokenization and chain/pipeline analysis to stop at unquoted shell comments, so allow-always persistence now tracks only commands that the shell can actually execute. Normal real chained commands and quoted # literals continue to work.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.2
Patched version: >= 2026.3.7

Fix Commit(s)

939b18475d734ed75173f59507e3ebbdfe1992b7

Release Process Note

npm 2026.3.7 was published on March 8, 2026. This advisory is fixed in the released package.

Thanks @tdjackey for reporting.

Database specific

{
    "cwe_ids":  [
        "CWE-436",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-09T19:54:46Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2026.3.7

Database specific

last_known_affected_version_range

"<= 2026.3.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9q2p-vc84-2rwm/GHSA-9q2p-vc84-2rwm.json"