https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:54:01 +0000 https://cve.radiocsirt.org/vuln/cve-2026-22179 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution syntax within double-quoted text to bypass security restrictions and execute arbitrary commands on the system.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution syntax within double-quoted text to bypass security restrictions and execute arbitrary commands on the system.</p> https://cve.radiocsirt.org/vuln/cve-2026-22179 https://cve.radiocsirt.org/vuln/ghsa-9p38-94jf-hgjj <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In OpenClaw&#39;s macOS node-host path, `system.run` allowlist parsing in `security=allowlist` mode failed to reject command substitution tokens when they appeared inside double-quoted shell text.</p> <p>Because of that gap, payloads like `echo &#34;ok $(id)&#34;` could be treated as allowlist hits (first executable token `echo`) while still executing non-allowlisted subcommands through shell substitution.</p> <p>### Affected Packages / Versions - Package: npm `openclaw` - Latest published affected version: `2026.2.21-2` - Affected range: `&lt;= 2026.2.21-2` - Patched version (planned next release): `2026.2.22`</p> <p>Notes: - Default installs are not affected (`security=deny` by default). - The issue requires opting into `security=allowlist` on the macOS node-host path.</p> <p>### Impact Approval/authorization bypass in allowlist mode that can lead to unintended command execution on the node host.</p> <p>### Preconditions - Target uses macOS node-host / companion-app execution path. - Exec approvals set to `security=allowlist`. - Ask mode is `on-miss` or `off`. - Allowlist contains a benign executable used in a shell wrapper flow (for example `/bin/echo`).</p> <p>### Reproduction (example) Use a shell-wrapper command where the visible executable is allowlisted but the quoted payload contains substitution:</p> <p>- command argv: `/bin/sh -lc &#39;echo &#34;ok $(/usr/bin/id &gt; /tmp/openclaw-poc-rce)&#34;&#39;` - allowlist pattern includes `/bin/echo`</p> <p>Before the fix, allowlist analysis could resolve this as allowlisted while shell subst…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In OpenClaw&#39;s macOS node-host path, `system.run` allowlist parsing in `security=allowlist` mode failed to reject command substitution tokens when they appeared inside double-quoted shell text.</p> <p>Because of that gap, payloads like `echo &#34;ok $(id)&#34;` could be treated as allowlist hits (first executable token `echo`) while still executing non-allowlisted subcommands through shell substitution.</p> <p>### Affected Packages / Versions - Package: npm `openclaw` - Latest published affected version: `2026.2.21-2` - Affected range: `&lt;= 2026.2.21-2` - Patched version (planned next release): `2026.2.22`</p> <p>Notes: - Default installs are not affected (`security=deny` by default). - The issue requires opting into `security=allowlist` on the macOS node-host path.</p> <p>### Impact Approval/authorization bypass in allowlist mode that can lead to unintended command execution on the node host.</p> <p>### Preconditions - Target uses macOS node-host / companion-app execution path. - Exec approvals set to `security=allowlist`. - Ask mode is `on-miss` or `off`. - Allowlist contains a benign executable used in a shell wrapper flow (for example `/bin/echo`).</p> <p>### Reproduction (example) Use a shell-wrapper command where the visible executable is allowlisted but the quoted payload contains substitution:</p> <p>- command argv: `/bin/sh -lc &#39;echo &#34;ok $(/usr/bin/id &gt; /tmp/openclaw-poc-rce)&#34;&#39;` - allowlist pattern includes `/bin/echo`</p> <p>Before the fix, allowlist analysis could resolve this as allowlisted while shell subst…</p> https://cve.radiocsirt.org/vuln/ghsa-9p38-94jf-hgjj