GHSA-m7x8-2w3w-pr42

Suggest an improvement
Source
https://github.com/advisories/GHSA-m7x8-2w3w-pr42
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-m7x8-2w3w-pr42/GHSA-m7x8-2w3w-pr42.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m7x8-2w3w-pr42
Aliases
Published
2026-02-18T00:46:54Z
Modified
2026-02-20T16:56:55.296515Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw has a command injection in maintainer clawtributors updater
Details

Summary

Command injection in the maintainer/dev script scripts/update-clawtributors.ts.

Impact

Affects contributors/maintainers (or CI) who run bun scripts/update-clawtributors.ts in a source checkout that contains a malicious commit author email (e.g. crafted @users.noreply.github.com values).

Normal CLI usage is not affected (npm i -g openclaw): this script is not part of the shipped CLI and is not executed during routine operation.

Affected Versions

  • Source checkouts: tags v2026.1.8 through v2026.2.13 (inclusive)
  • Version range (structured): >= 2026.1.8, < 2026.2.14

Details

The script derived a GitHub login from git log author metadata and interpolated it into a shell command (via execSync). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run.

Fix

  • Fix commit: a429380e337152746031d290432a4b93aa553d55
  • Planned patched version: 2026.2.14

Credits

Thanks @scanleale and @MegaManSec (https://joshua.hu) of AISLE Research Team for reporting.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2026-02-19T23:16:25Z",
    "severity": "HIGH",
    "github_reviewed_at": "2026-02-18T00:46:54Z"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
2026.1.8
Fixed
2026.2.14

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-m7x8-2w3w-pr42/GHSA-m7x8-2w3w-pr42.json"