https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 16:26:00 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53829 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>OpenClaw exec approvals could show a shortened command in the approval UI while keeping the full original command for execution. For very long commands, an approver could see and approve a benign-looking prefix while a hidden suffix remained part of the command that would run after approval.</p> <p>This issue affects the approval display and binding for oversized exec commands. It does not make exec available to unauthenticated users, and it does not change OpenClaw&#39;s local-first trust model.</p> <p>### Affected configurations</p> <p>This affects deployments where exec approval is enabled and an authenticated caller can create a pending host exec request with a command long enough to be truncated in the approval view.</p> <p>### Impact</p> <p>An approver could make a decision from incomplete command text. If the hidden suffix contained additional shell operations, those operations could run after the approval was resolved.</p> <p>The practical impact depends on who can request exec approvals and who is allowed to approve them. The issue is an approval integrity problem: the approval surface did not faithfully represent the command that would execute.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, avoid approving unusually long exec commands and keep approval capability limited to trusted operators.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>OpenClaw exec approvals could show a shortened command in the approval UI while keeping the full original command for execution. For very long commands, an approver could see and approve a benign-looking prefix while a hidden suffix remained part of the command that would run after approval.</p> <p>This issue affects the approval display and binding for oversized exec commands. It does not make exec available to unauthenticated users, and it does not change OpenClaw&#39;s local-first trust model.</p> <p>### Affected configurations</p> <p>This affects deployments where exec approval is enabled and an authenticated caller can create a pending host exec request with a command long enough to be truncated in the approval view.</p> <p>### Impact</p> <p>An approver could make a decision from incomplete command text. If the hidden suffix contained additional shell operations, those operations could run after the approval was resolved.</p> <p>The practical impact depends on who can request exec approvals and who is allowed to approve them. The issue is an approval integrity problem: the approval surface did not faithfully represent the command that would execute.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, avoid approving unusually long exec commands and keep approval capability limited to trusted operators.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53829