https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:22:13 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28470 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>Exec approvals allowlist bypass via command substitution/backticks inside double quotes.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.1` - Fixed: `&gt;= 2026.2.2`</p> <p>### Impact</p> <p>Only affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are unaffected.</p> <p>### Fix</p> <p>Reject unescaped `$()` and backticks inside double quotes during allowlist analysis.</p> <p>### Fix Commit(s)</p> <p>- d1ecb46076145deb188abcba8f0699709ea17198</p> <p>Thanks @simecek for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>Exec approvals allowlist bypass via command substitution/backticks inside double quotes.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.1` - Fixed: `&gt;= 2026.2.2`</p> <p>### Impact</p> <p>Only affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are unaffected.</p> <p>### Fix</p> <p>Reject unescaped `$()` and backticks inside double quotes during allowlist analysis.</p> <p>### Fix Commit(s)</p> <p>- d1ecb46076145deb188abcba8f0699709ea17198</p> <p>Thanks @simecek for reporting.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28470 https://db.gcve.eu/vuln/cve-2026-28470 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.</p> https://db.gcve.eu/vuln/cve-2026-28470