Advisory details:
github_osv / GHSA-xvhf-x56f-2hpp
| Advisory ID | github_osv/GHSA-xvhf-x56f-2hpp |
| Aliases |
CVE-2026-28463
|
| Summary | OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion ## Summary OpenClaw's exec-approvals allowlist supports a small set of "safe bins" intended to be stdin-only (no positional file arguments) when running `tools.exec.host=gateway|node` with `security=allowlist`. In affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (`sh -c`) which expands globs and environment variables. This allowed safe bins like `head`, `tail`, or `grep` to read arbitrary local files via tokens such as `*` or `$HOME/...` without triggering approvals. This issue is configuration-dependent and is not exercised by default settings (default `tools.exec.host` is `sandbox`). ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.13` - Patched: `>= 2026.2.14` (planned; publish the advisory after the npm release is out) ## Impact An authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode. ## Fix Safe-bins executions now force argv tokens to be treated as literal text at execution time (single-quoted), preventing globbing and `$VARS` expansion from turning "safe" tokens into file paths. ## Fix Commit(s) - 77b89719d5b7e271f48b6f49e334a8b991468c3b ## Release Process Note `patched_versions` is pre-set for the next planned release (`>= 2026.2.14`) so publishing is a single click once that npm version is available. Thanks @christos-eth for reporting. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.7 |
| Risk | 3.9 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.7 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-xvhf-x56f-2hpp/GHSA-xvhf-x56f-2hpp.json |
| cvssv4 | 8.6 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-xvhf-x56f-2hpp/GHSA-xvhf-x56f-2hpp.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-09T17:48:13Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/28xxx/CVE-2026-28463.json
Source Advisory: vulnrichment/CVE-2026-28463
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]