GHSA-gwqp-86q6-w47g

Suggest an improvement
Source
https://github.com/advisories/GHSA-gwqp-86q6-w47g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gwqp-86q6-w47g/GHSA-gwqp-86q6-w47g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gwqp-86q6-w47g
Aliases
Downstream
Published
2026-03-02T22:30:43Z
Modified
2026-03-18T01:56:22Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw's exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toybox sh -c)
Details

Summary

OpenClaw exec approvals could be bypassed in allowlist mode when allow-always was granted through unrecognized multiplexer shell wrappers (notably busybox sh -c and toybox sh -c).

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.22-2
  • Latest published vulnerable version at triage time: 2026.2.22-2 (checked on February 24, 2026)
  • Fixed on main: yes
  • Patched release: 2026.2.23

Details

Wrapper analysis treated busybox/toybox invocations as non-wrapper commands in this path, so allow-always persisted the wrapper binary path instead of the inner executable. That allowed later arbitrary payloads under the same multiplexer wrapper to satisfy the stored allowlist rule.

The fix hardens wrapper detection and persistence behavior for these multiplexer shell applets so approvals bind to intended inner executables and fail closed when unwrap safety is uncertain.

Fix Commit(s)

  • a67689a7e3ad494b6637c76235a664322d526f9e

Release Process Note

patched_versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.

OpenClaw thanks @jiseoung for reporting.

Database specific 
{
    "cwe_ids":  [
        "CWE-184"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-02T22:30:43Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.2.23

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gwqp-86q6-w47g/GHSA-gwqp-86q6-w47g.json"