https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:54:08.452382+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41390 CVE-2026-41390 — OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper 2026-10-05T14:54:08.485437+00:00

Affected: OpenClaw

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

 https://cve.radiocsirt.org/vuln/ghsa-6pfc-6m7w-m8fx GHSA-6pfc-6m7w-m8fx — OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper 2026-10-05T14:54:08.485496+00:00

Affected: npm: openclaw

## Summary

Allow-always persistence did not unwrap `/usr/bin/script` and similar wrappers to the actual executed target before storing trust decisions.

## Impact

A user approval for one wrapped command could persist trust for a wrapper binary that later executed a different underlying program.

## Affected Component

`src/infra/dispatch-wrapper-resolution.ts, src/infra/exec-wrapper-resolution.ts`

## Fixed Versions

- Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `83da3cfe31` (`infra: unwrap script wrapper approval targets`).