https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:21:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-22175 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through unrecognized multiplexer shell wrappers like busybox and toybox sh -c commands. Attackers can exploit this by invoking arbitrary payloads under the same multiplexer wrapper to satisfy stored allowlist rules, bypassing intended execution restrictions.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through unrecognized multiplexer shell wrappers like busybox and toybox sh -c commands. Attackers can exploit this by invoking arbitrary payloads under the same multiplexer wrapper to satisfy stored allowlist rules, bypassing intended execution restrictions.</p> https://vulnerability.circl.lu/vuln/cve-2026-22175 https://vulnerability.circl.lu/vuln/ghsa-gwqp-86q6-w47g <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw exec approvals could be bypassed in `allowlist` mode when `allow-always` was granted through unrecognized multiplexer shell wrappers (notably `busybox sh -c` and `toybox sh -c`).</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.22-2` - Latest published vulnerable version at triage time: `2026.2.22-2` (checked on February 24, 2026) - Fixed on `main`: yes - Patched release: `2026.2.23`</p> <p>### Details Wrapper analysis treated `busybox`/`toybox` invocations as non-wrapper commands in this path, so `allow-always` persisted the wrapper binary path instead of the inner executable. That allowed later arbitrary payloads under the same multiplexer wrapper to satisfy the stored allowlist rule.</p> <p>The fix hardens wrapper detection and persistence behavior for these multiplexer shell applets so approvals bind to intended inner executables and fail closed when unwrap safety is uncertain.</p> <p>### Fix Commit(s) - `a67689a7e3ad494b6637c76235a664322d526f9e`</p> <p>### Release Process Note `patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.</p> <p>OpenClaw thanks @jiseoung for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw exec approvals could be bypassed in `allowlist` mode when `allow-always` was granted through unrecognized multiplexer shell wrappers (notably `busybox sh -c` and `toybox sh -c`).</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.22-2` - Latest published vulnerable version at triage time: `2026.2.22-2` (checked on February 24, 2026) - Fixed on `main`: yes - Patched release: `2026.2.23`</p> <p>### Details Wrapper analysis treated `busybox`/`toybox` invocations as non-wrapper commands in this path, so `allow-always` persisted the wrapper binary path instead of the inner executable. That allowed later arbitrary payloads under the same multiplexer wrapper to satisfy the stored allowlist rule.</p> <p>The fix hardens wrapper detection and persistence behavior for these multiplexer shell applets so approvals bind to intended inner executables and fail closed when unwrap safety is uncertain.</p> <p>### Fix Commit(s) - `a67689a7e3ad494b6637c76235a664322d526f9e`</p> <p>### Release Process Note `patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.</p> <p>OpenClaw thanks @jiseoung for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-gwqp-86q6-w47g