228 matches found
PT-2026-26228
Summary In [email protected], node system.run approval-path hardening rewrote wrapper command argv in a way that changed execution semantics. A command shown/approved as a shell payload for example echo SAFE could execute a different local script when wrapper argv were rewritten. Affected Package...
PT-2026-25461
Summary In [email protected], node system.run approval-path hardening rewrote wrapper command argv in a way that changed execution semantics. A command shown/approved as a shell payload for example echo SAFE could execute a different local script when wrapper argv were rewritten. Affected Package...
GHSA-HWPQ-RRPF-PGCQ OpenClaw: system.run approval identity mismatch could execute a different binary than displayed
Summary system.run approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw. Affected...
PT-2026-25123
Summary system.run approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw. Affected...
GHSA-6C9J-X93C-RW6J OpenClaw safeBins file-existence oracle information disclosure
An information disclosure vulnerability in OpenClaw's tools.exec.safeBins approval flow allowed a file-existence oracle. When safe-bin validation examined candidate file paths, command allow/deny behavior could differ based on whether a path already existed on the host filesystem. An attacker cou...
Command Injection
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Command Injection via the exec-approvals allowlist, when shell expansion is performed on argv tokens. An attacker can access sensitive files by supplying crafted arguments that leverage...
Azure Linux 3.0 Security Update: util-linux (CVE-2024-28085)
The version of util-linux installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28085 advisory. - wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to...
CVE-2026-22188 Panda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()
The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argvcopy and argvcopy2 using alloca based directly on the attacker-controlled argc value without validation...
CVE-2026-22188
Panda3D up to version 1.10.16 is affected by a DoS due to unbounded stack allocation in the deploy-stub. The deploy-stub allocates argv_copy and argv_copy2 with alloca() based on attacker-controlled argc without validation, which can exhaust stack space and crash the process during Python interpr...
SUSE CVE-2023-54162
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix possible memory leak in smb2lock argv needs to be free when setupasyncwork fails or when the current process is woken up...
CVE-2023-54162
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix possible memory leak in smb2lock argv needs to be free when setupasyncwork fails or when the current process is woken up...
CVE-2023-54162 ksmbd: fix possible memory leak in smb2_lock()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix possible memory leak in smb2lock argv needs to be free when setupasyncwork fails or when the current process is woken up...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990553)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990553 advisory. In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: In several other...
Unity Linux 20.1050e Security Update: kernel (UTSA-2025-989913)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989913 advisory. In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: In several other...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989844)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989844 advisory. In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: In several other...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989395)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989395 advisory. In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: In several other...
JLSEC-2025-194 wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape...
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked. There may be plausible...
PT-2025-45986
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked. There may be plausible...
EUVD-2022-54962
In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program, thus prohibiting a scenario...