https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 14:36:35 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-ghsa-ff98-w8hj-qrxf <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`).</p> <p>### Impact Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version reviewed: `2026.2.17` - Affected range for this advisory record: `&lt;= 2026.2.17` - Planned patched version metadata: `2026.2.19` (next release line)</p> <p>### Fix Commit(s) - `2e421f32dfc589c02706265fd3c3137ffc06c4b1`</p> <p>### Remediation - Install only trusted plugins. - Use `plugins.allow` to pin explicit trusted plugin IDs. - SECURITY.md now explicitly documents that plugin runtime helpers are convenience APIs, not a sandbox boundary.</p> <p>OpenClaw thanks @markmusson for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`).</p> <p>### Impact Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version reviewed: `2026.2.17` - Affected range for this advisory record: `&lt;= 2026.2.17` - Planned patched version metadata: `2026.2.19` (next release line)</p> <p>### Fix Commit(s) - `2e421f32dfc589c02706265fd3c3137ffc06c4b1`</p> <p>### Remediation - Install only trusted plugins. - Use `plugins.allow` to pin explicit trusted plugin IDs. - SECURITY.md now explicitly documents that plugin runtime helpers are convenience APIs, not a sandbox boundary.</p> <p>OpenClaw thanks @markmusson for reporting.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-ghsa-ff98-w8hj-qrxf