Skip to content

Commit 8c2c220

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8g75-q649-6pv6 GHSA-qc36-x95h-7j53 GHSA-rwwx-25m7-ww73 GHSA-wmgj-hrx3-23gj GHSA-wwrj-437c-ppq4 GHSA-xf99-j42q-5w5p GHSA-rwwx-25m7-ww73 GHSA-wmgj-hrx3-23gj
1 parent d6b374b commit 8c2c220

8 files changed

Lines changed: 192 additions & 102 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-8g75-q649-6pv6/GHSA-8g75-q649-6pv6.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8g75-q649-6pv6",
4-
"modified": "2026-03-12T14:21:28Z",
4+
"modified": "2026-04-06T22:37:15Z",
55
"published": "2026-03-12T14:21:28Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-32921"
8+
],
79
"summary": "OpenClaw's system.run approvals did not bind mutable script operands across approval and execution",
810
"details": "OpenClaw's `system.run` approval flow did not bind mutable interpreter-style script operands across approval and execution.\n\nA caller could obtain approval for an execution such as `sh ./script.sh`, rewrite the approved script before execution, and then execute different content under the previously approved command shape. The approved `argv` values remained the same, but the mutable script operand content could drift after approval.\n\nLatest published npm version verified vulnerable: `2026.3.7`\n\nThe initial March 7, 2026 fix in `c76d29208bf6a7f058d2cf582519d28069e42240` added approval binding for shell scripts and a narrow interpreter set, but follow-up maintainer review on March 8, 2026 found that `bun` and `deno` script operands still did not produce `mutableFileOperand` snapshots.\n\nA complete fix shipped on March 9, 2026 in `cf3a479bd1204f62eef7dd82b4aa328749ae6c91`, which binds approved `bun` and `deno run` script operands to on-disk file snapshots and denies post-approval script drift before execution.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.3.7`\n- Patched version: `2026.3.8`\n\n## Fix Commit(s)\n\n- `c76d29208bf6a7f058d2cf582519d28069e42240`\n- `cf3a479bd1204f62eef7dd82b4aa328749ae6c91`\n\n## Release Verification\n\n- npm `2026.3.7` remains vulnerable.\n- npm `2026.3.8` contains the completed fix.\n\nThanks @tdjackey for reporting.",
911
"severity": [
@@ -41,6 +43,10 @@
4143
"type": "WEB",
4244
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32921"
49+
},
4450
{
4551
"type": "WEB",
4652
"url": "https://github.com/openclaw/openclaw/commit/c76d29208bf6a7f058d2cf582519d28069e42240"
@@ -52,6 +58,10 @@
5258
{
5359
"type": "PACKAGE",
5460
"url": "https://github.com/openclaw/openclaw"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://www.vulncheck.com/advisories/openclaw-script-content-modification-via-mutable-operand-binding-in-system-run"
5565
}
5666
],
5767
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-qc36-x95h-7j53/GHSA-qc36-x95h-7j53.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qc36-x95h-7j53",
4-
"modified": "2026-03-13T15:48:05Z",
4+
"modified": "2026-04-06T22:35:57Z",
55
"published": "2026-03-13T15:48:05Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-32978"
8+
],
79
"summary": "OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity",
810
"details": "## Summary\nIn affected versions of `openclaw`, node-host `system.run` approvals did not bind a mutable file operand for some script runners, including forms such as `tsx` and `jiti`. An attacker could obtain approval for a benign script-runner command, rewrite the referenced script on disk, and have the modified code execute under the already approved run context.\n\n## Impact\nDeployments that rely on node-host `system.run` approvals for script integrity could execute rewritten local code after operator approval. This can lead to unintended local code execution as the OpenClaw runtime user.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `< 2026.3.11`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe approval planner only tracked mutable script operands for a hardcoded set of interpreters and runtime forms. Commands such as `tsx ./run.ts` and `jiti ./run.ts` fell through without a bound file snapshot, so the final pre-execution revalidation step was skipped.\n\n## Fix\nOpenClaw now fails closed for approval-backed interpreter and runtime commands unless it can bind exactly one concrete local file operand, and it extends direct-file binding coverage for additional runtime forms. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
911
"severity": [
@@ -38,13 +40,21 @@
3840
"type": "WEB",
3941
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53"
4042
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32978"
46+
},
4147
{
4248
"type": "PACKAGE",
4349
"url": "https://github.com/openclaw/openclaw"
4450
},
4551
{
4652
"type": "WEB",
4753
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-unrecognized-script-runners"
4858
}
4959
],
5060
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-rwwx-25m7-ww73/GHSA-rwwx-25m7-ww73.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rwwx-25m7-ww73",
4+
"modified": "2026-04-06T22:35:49Z",
5+
"published": "2026-03-29T15:30:19Z",
6+
"withdrawn": "2026-04-06T22:35:49Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qc36-x95h-7j53. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.12"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32978"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-unrecognized-script-runners"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-863"
58+
],
59+
"severity": "CRITICAL",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-06T22:35:49Z",
62+
"nvd_published_at": "2026-03-29T13:17:01Z"
63+
}
64+
}

‎advisories/github-reviewed/2026/03/GHSA-wmgj-hrx3-23gj/GHSA-wmgj-hrx3-23gj.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wmgj-hrx3-23gj",
4+
"modified": "2026-04-06T22:36:11Z",
5+
"published": "2026-03-29T15:30:19Z",
6+
"withdrawn": "2026-04-06T22:36:11Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xf99-j42q-5w5p. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval and execution when exact file binding cannot occur. Remote attackers can change approved local scripts before execution to achieve unintended code execution as the OpenClaw runtime user.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.11"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xf99-j42q-5w5p"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32979"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.vulncheck.com/advisories/openclaw-unbound-interpreter-and-runtime-commands-bypass-in-node-host-approval"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-367"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-06T22:36:11Z",
62+
"nvd_published_at": "2026-03-29T13:17:02Z"
63+
}
64+
}

advisories/unreviewed/2026/03/GHSA-wwrj-437c-ppq4/GHSA-wwrj-437c-ppq4.json renamed to advisories/github-reviewed/2026/03/GHSA-wwrj-437c-ppq4/GHSA-wwrj-437c-ppq4.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wwrj-437c-ppq4",
4-
"modified": "2026-03-31T12:31:35Z",
4+
"modified": "2026-04-06T22:37:07Z",
55
"published": "2026-03-31T12:31:35Z",
6-
"aliases": [
7-
"CVE-2026-32921"
8-
],
9-
"details": "OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.",
6+
"withdrawn": "2026-04-06T22:37:07Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's system.run approvals did not bind mutable script operands across approval and execution",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8g75-q649-6pv6. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -17,7 +17,27 @@
1717
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1818
}
1919
],
20-
"affected": [],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.8"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
2141
"references": [
2242
{
2343
"type": "WEB",
@@ -45,8 +65,8 @@
4565
"CWE-367"
4666
],
4767
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-04-06T22:37:07Z",
5070
"nvd_published_at": "2026-03-31T12:16:28Z"
5171
}
5272
}

‎advisories/github-reviewed/2026/03/GHSA-xf99-j42q-5w5p/GHSA-xf99-j42q-5w5p.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xf99-j42q-5w5p",
4-
"modified": "2026-03-13T15:47:41Z",
4+
"modified": "2026-04-06T22:36:18Z",
55
"published": "2026-03-13T15:47:41Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-32979"
8+
],
79
"summary": "OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity",
810
"details": "## Summary\nIn affected versions of `openclaw`, node-host `system.run` approvals could still execute rewritten local code for interpreter and runtime commands when OpenClaw could not bind exactly one concrete local file operand during approval planning.\n\n## Impact\nDeployments using node-host `system.run` approval mode could approve a benign local script and then execute different local code if that script changed before execution. This can lead to unintended local code execution as the OpenClaw runtime user.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.3.8`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe approval flow treated some interpreter and runtime forms as approval-backed even when it could not honestly bind a single direct local script file. That left residual approval-integrity gaps for runtime forms outside the directly bound file set.\n\n## Fix\nOpenClaw now fails closed for approval-backed interpreter and runtime commands unless it can bind exactly one concrete local file operand, and it extends best-effort direct-file binding for additional runtime forms. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
911
"severity": [
@@ -38,13 +40,21 @@
3840
"type": "WEB",
3941
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xf99-j42q-5w5p"
4042
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32979"
46+
},
4147
{
4248
"type": "PACKAGE",
4349
"url": "https://github.com/openclaw/openclaw"
4450
},
4551
{
4652
"type": "WEB",
4753
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://www.vulncheck.com/advisories/openclaw-unbound-interpreter-and-runtime-commands-bypass-in-node-host-approval"
4858
}
4959
],
5060
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-rwwx-25m7-ww73/GHSA-rwwx-25m7-ww73.json‎

Lines changed: 0 additions & 44 deletions
This file was deleted.

‎advisories/unreviewed/2026/03/GHSA-wmgj-hrx3-23gj/GHSA-wmgj-hrx3-23gj.json‎

Lines changed: 0 additions & 44 deletions
This file was deleted.

0 commit comments

Comments
 (0)