Advisory details:
github_osv / GHSA-7ff8-xjh3-mgh6
| Advisory ID | github_osv/GHSA-7ff8-xjh3-mgh6 |
| Aliases | |
| Summary | OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt ### Summary In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval configuration could allow a skill-name collision to bypass an `ask=on-miss` prompt. When `autoAllowSkills=true`, a path-scoped executable such as `./skill-bin` could resolve to basename `skill-bin`, satisfy the `skills` allowlist segment, and run without prompting for approval. ### Affected Packages / Versions - Package: `npm openclaw` - Affected versions: `<= 2026.2.22-2` - Patched versions: `>= 2026.2.23` (released) ### Configuration Scope (Not Default) This behavior requires non-default settings and does not affect default installs. Required conditions: - `autoAllowSkills=true` (default is `false`) - `system.run` with `security=allowlist` - `ask=on-miss` ### Technical Details The allowlist evaluator accepted `skills` satisfaction by bin-name match, so `./skill-bin` could match `skillBins.has("skill-bin")` after resolution. The fix hardens skill auto-allow matching by requiring: - a pathless invocation token (no `/` or `\\`), and - a trusted resolved executable path for that skill bin on the machine where skills run. This preserves normal `skill-bin ...` behavior while preventing `./<skill-bin>` and absolute-path basename collisions from auto-satisfying `skills`. ### Impact In affected non-default configurations, approval prompts could be skipped for commands that should have required operator confirmation. ### Fix Commit(s) - `ffd63b7a2c4c6d5aeb4710ef951d5794ad7ad77b` (`fix(security): trust resolved skill-bin paths in allowlist auto-allow`) OpenClaw thanks @tdjackey for reporting. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.6 |
| Risk | 3.3 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-863 | Incorrect Authorization |
| CWE-266 | Incorrect Privilege Assignment |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 7.3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-7ff8-xjh3-mgh6/GHSA-7ff8-xjh3-mgh6.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
There are no SSVC decisions available.