GHSA-rwwx-25m7-ww73
Suggest an improvement- Source
- https://github.com/advisories/GHSA-rwwx-25m7-ww73
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rwwx-25m7-ww73/GHSA-rwwx-25m7-ww73.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-rwwx-25m7-ww73
- Downstream
- Withdrawn
- 2026-04-06T22:35:49Z
- Published
- 2026-03-29T15:30:19Z
- Modified
- 2026-04-06T22:50:21Z
- Severity
-
- 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- Duplicate Advisory: OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
- Details
-
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qc36-x95h-7j53. This link is maintained to preserve external references.
Original Description
OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.
- Database specific
{ "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-04-06T22:35:49Z", "nvd_published_at": "2026-03-29T13:17:01Z", "severity": "CRITICAL" }- References
Affected packages
npm / openclaw
Package
- Name
- openclaw
- View open source insights on deps.dev
- Purl
- pkg:npm/openclaw