Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/GHSA-F8R2-VG7X-GH8M.md

Created March 14, 2026 09:40
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/fa1a2b38eaeb0cbf7ed3c7205c4f47db to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/fa1a2b38eaeb0cbf7ed3c7205c4f47db to your computer and use it in GitHub Desktop.
Download ZIP
GHSA-F8R2-VG7X-GH8M: GHSA-f8r2-vg7x-gh8m: Path Overmatching and Command Execution Bypass in OpenClaw - CVE Security Report
Raw
GHSA-F8R2-VG7X-GH8M.md

GHSA-F8R2-VG7X-GH8M: GHSA-f8r2-vg7x-gh8m: Path Overmatching and Command Execution Bypass in OpenClaw

CVSS Score: 5.3 Published: 2026-03-13 Full Report: https://cvereports.com/reports/GHSA-F8R2-VG7X-GH8M

Summary

OpenClaw versions up to 2026.3.8 suffer from an improper input validation vulnerability in the command execution allowlist mechanism. Flawed pattern matching logic, including improper lowercasing on POSIX systems and broad glob wildcard handling, allows an attacker to bypass execution restrictions and invoke unauthorized commands.

TL;DR

A path overmatching flaw in OpenClaw's execution allowlist permits unauthorized command execution on POSIX systems by exploiting case insensitivity and broad glob wildcard matching.

Exploit Status: POC

Technical Details

  • Vulnerability Type: Improper Input Validation / Path Overmatching
  • CWE IDs: CWE-178, CWE-1286, CWE-22
  • CVSS v4 Score: 5.3 (Medium)
  • Attack Vector: Network
  • Exploit Status: Proof of Concept (PoC)
  • Impact: Unauthorized Command Execution / RCE

Affected Systems

  • OpenClaw (formerly Moltbot/ClawdBot) running on POSIX systems (Linux, macOS)
  • openclaw: <= 2026.3.8 (Fixed in: 2026.3.11)

Mitigation

  • Upgrade the openclaw package to a patched version
  • Audit and harden execution allowlist configurations
  • Enforce principle of least privilege for the OpenClaw service

Remediation Steps:

  1. Identify the current version of the openclaw package running in the environment.
  2. Run 'npm install openclaw@2026.3.12' to upgrade to the secure release.
  3. Review the configuration files containing the execution allowlist.
  4. Replace any entries utilizing the '?' wildcard with explicit, absolute paths to required binaries.
  5. Restart the OpenClaw gateway services to apply the updated code and configurations.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment