GHSA-7977-C43C-XPWJ OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations such as --compress-prog in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was...

CVE-2026-28363

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations such as --compress-prog in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was...

CVE-2026-28363

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations such as --compress-prog in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was...

CVE-2026-28363

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations such as --compress-prog in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was...

CVE-2026-28363

OpenClaw prior to version 2026.2.23 contains a vulnerability in tools.exec.safeBins sort validation that can be bypassed using GNU long-option abbreviations (e.g., --compress-prog) when in allowlist mode. This leads to approval-free execution paths that were intended to require explicit approval,...

CVE-2026-28363

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations such as --compress-prog in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was...

CVE-2026-28363: Incomplete List of Disallowed Inputs

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations such as --compress-prog in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was...

PT-2026-22291

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.23 Description The software contains a validation bypass in the tools.exec.safeBins logic for the sort command. This bypass occurs when using GNU long-option abbreviations such as --compress-prog in allowlist...