Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseGHSA-3c6h-g97w-fg78
GHSA-3c6h-g97w-fg78:
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation
Summary
In OpenClaw, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations in allowlist mode, allowing approval-free execution paths that should require approval.
Affected Packages / Versions
- Ecosystem: npm
- Package:
openclaw - Latest published version checked:
2026.2.22-2 - Affected range:
<= 2026.2.22-2 - Fixed version:
2026.2.23
Impact
When all of the following are true:
tools.exec.security=allowlisttools.exec.ask=on-misstools.exec.safeBinsincludessortabbreviated GNU long options (for example--compress-prog) could bypass denied-flag checks and be treated as allowlist-satisfied safe-bin usage, skipping approval.
Root Cause
Long-option handling matched denied flags by exact string and accepted unknown long options with inline values instead of failing closed.
Fix Commit(s)
3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f
Release Process Note
patched_versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.
OpenClaw thanks @tdjackey for reporting.
Source: NVD
Related OpenClaw (formerly Moltbot or Clawdbot) vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management