{"id":"GHSA-mhq8-78pj-5j79","title":"OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion","summary":"OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion","severity":"high","cvss":7.1,"cwe":["CWE-78","CWE-200","CWE-284"],"vendor":"openclaw","product":"openclaw","ecosystem":"npm","affected":["openclaw < 2026.5.18"],"patched":["openclaw 2026.5.18"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mhq8-78pj-5j79","references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mhq8-78pj-5j79"},{"url":"https://github.com/advisories/GHSA-mhq8-78pj-5j79"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-02T16:39:34.593Z","slug":"GHSA-mhq8-78pj-5j79","body":"## Overview\n\n### Summary\n\nOn POSIX nodes, OpenClaw's `system.run` safe-bin checks could approve a command before shell expansion changed how the command was interpreted. A value that appeared to be a safe-bin argument could expand into additional shell words and become a file operand.\n\nThis issue is limited to paired POSIX node execution through `system.run` with safe-bin or allowlist-style auto-approval. It is not an unauthenticated node takeover.\n\n### Affected configurations\n\nThis affects deployments where:\n\n- a POSIX node is paired to the gateway\n- `system.run` is reachable by an authenticated operator or agent flow\n- exec policy uses safe-bin or allowlist-based auto-approval\n- the approved command contains shell-expanded values that can change argv shape\n\n### Impact\n\nA lower-privilege operator flow could cause an approved safe-bin command to read a node-local file that was not intended by the policy. Depending on the local files available to the node process, this could expose OpenClaw configuration data or other node-local information.\n\nThe issue is a policy-enforcement gap in argv validation, not a general statement that every safe-bin command is unsafe.\n\n### Patched Versions\n\nThe first stable patched version is `2026.5.18`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.5.18` or later. Before upgrading, avoid broad safe-bin auto-approval for commands that can read arbitrary paths, and prefer explicit approval for node commands that touch local files.\n\n## Affected packages\n\n- `openclaw < 2026.5.18`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openclaw 2026.5.18`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}