https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 11:38:17 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28391 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>On Windows nodes, exec requests were executed via `cmd.exe /d /s /c &lt;rawCommand&gt;`. In allowlist/approval-gated mode, the allowlist analysis did not model Windows `cmd.exe` parsing and metacharacter behavior. A crafted command string could cause `cmd.exe` to interpret additional operations (for example command chaining via `&amp;`, or expansion via `%...%` / `!...!`) beyond what was allowlisted/approved.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.1` - Patched: `&gt;= 2026.2.2` - Latest (npm) as of 2026-02-14: `2026.2.13`</p> <p>### Details</p> <p>- Default installs: Not affected unless you opt into exec allowlist/approval gating on Windows nodes. - Windows execution uses `cmd.exe` via `src/infra/node-shell.ts`. - The fix hardens Windows allowlist enforcement by: - Passing the platform into allowlist analysis and rejecting Windows shell metacharacters. - Treating `cmd.exe` invocation as not allowlist-safe on Windows. - Avoiding `cmd.exe` entirely in allowlist mode by executing the parsed argv directly when possible.</p> <p>### Fix Commit(s)</p> <p>- `a7f4a53ce80c98ba1452eb90802d447fca9bf3d6`</p> <p>Thanks @simecek for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>On Windows nodes, exec requests were executed via `cmd.exe /d /s /c &lt;rawCommand&gt;`. In allowlist/approval-gated mode, the allowlist analysis did not model Windows `cmd.exe` parsing and metacharacter behavior. A crafted command string could cause `cmd.exe` to interpret additional operations (for example command chaining via `&amp;`, or expansion via `%...%` / `!...!`) beyond what was allowlisted/approved.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.1` - Patched: `&gt;= 2026.2.2` - Latest (npm) as of 2026-02-14: `2026.2.13`</p> <p>### Details</p> <p>- Default installs: Not affected unless you opt into exec allowlist/approval gating on Windows nodes. - Windows execution uses `cmd.exe` via `src/infra/node-shell.ts`. - The fix hardens Windows allowlist enforcement by: - Passing the platform into allowlist analysis and rejecting Windows shell metacharacters. - Treating `cmd.exe` invocation as not allowlist-safe on Windows. - Avoiding `cmd.exe` entirely in allowlist mode by executing the parsed argv directly when possible.</p> <p>### Fix Commit(s)</p> <p>- `a7f4a53ce80c98ba1452eb90802d447fca9bf3d6`</p> <p>Thanks @simecek for reporting.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28391 https://db.gcve.eu/vuln/cve-2026-28391 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like &amp; or %...% to execute unapproved commands beyond the allowlisted operations.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like &amp; or %...% to execute unapproved commands beyond the allowlisted operations.</p> https://db.gcve.eu/vuln/cve-2026-28391