{"id":"GHSA-xvhf-x56f-2hpp","summary":"OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion","details":"## Summary\n\nOpenClaw's exec-approvals allowlist supports a small set of \"safe bins\" intended to be stdin-only (no positional file arguments) when running `tools.exec.host=gateway|node` with `security=allowlist`.\n\nIn affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (`sh -c`) which expands globs and environment variables. This allowed safe bins like `head`, `tail`, or `grep` to read arbitrary local files via tokens such as `*` or `$HOME/...` without triggering approvals.\n\nThis issue is configuration-dependent and is not exercised by default settings (default `tools.exec.host` is `sandbox`).\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.13`\n- Patched: `\u003e= 2026.2.14` (planned; publish the advisory after the npm release is out)\n\n## Impact\n\nAn authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode.\n\n## Fix\n\nSafe-bins executions now force argv tokens to be treated as literal text at execution time (single-quoted), preventing globbing and `$VARS` expansion from turning \"safe\" tokens into file paths.\n\n## Fix Commit(s)\n\n- 77b89719d5b7e271f48b6f49e334a8b991468c3b\n\n## Release Process Note\n\n`patched_versions` is pre-set for the next planned release (`\u003e= 2026.2.14`) so publishing is a single click once that npm version is available.\n\nThanks @christos-eth for reporting.","aliases":["CVE-2026-28463"],"modified":"2026-03-06T01:16:27.386257Z","published":"2026-02-18T00:50:47Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-02-18T00:50:47Z","nvd_published_at":"2026-03-05T22:16:19Z","cwe_ids":["CWE-78"]},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xvhf-x56f-2hpp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28463"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/77b89719d5b7e271f48b6f49e334a8b991468c3b"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-shell-expansion-in-safe-bins-allowlist"}],"affected":[{"package":{"name":"openclaw","ecosystem":"npm","purl":"pkg:npm/openclaw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.14"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-xvhf-x56f-2hpp/GHSA-xvhf-x56f-2hpp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}