https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:42:54 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32973 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.</p> https://cve.radiocsirt.org/vuln/cve-2026-32973 https://cve.radiocsirt.org/vuln/ghsa-f8r2-vg7x-gh8m <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>`matchesExecAllowlistPattern` normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the `?` wildcard could match `/`, which allowed matches to cross path segments.</p> <p>### Impact</p> <p>These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.</p> <p>### Affected versions</p> <p>`openclaw` `&lt;= 2026.3.8`</p> <p>### Patch</p> <p>Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>`matchesExecAllowlistPattern` normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the `?` wildcard could match `/`, which allowed matches to cross path segments.</p> <p>### Impact</p> <p>These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.</p> <p>### Affected versions</p> <p>`openclaw` `&lt;= 2026.3.8`</p> <p>### Patch</p> <p>Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.</p> https://cve.radiocsirt.org/vuln/ghsa-f8r2-vg7x-gh8m