https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T06:35:36.586299+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-42423 BREW-openclaw-cli-CVE-2026-42423 — OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec ho… 2026-09-29T06:35:36.587800+00:00

Affected: Homebrew: openclaw-cli

## Impact

strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts.

The approval-timeout fallback could allow inline eval commands that strictInlineEval was meant to require explicit approval for.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected versions: `<=2026.4.2` - Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @zsxsoft and @KeenSecurityLab for reporting.

 https://db.gcve.eu/vuln/cve-2026-42423 CVE-2026-42423 — OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback 2026-09-29T06:35:36.587877+00:00

Affected: OpenClaw

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary.