https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 12:37:21 +0000 https://vulnerability.circl.lu/vuln/brew-openclaw-cli-ghsa-8mf7-vv8w-hjr2 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute inline payloads via flags like `-c`.</p> <p>This requires explicit operator configuration to add such binaries to `safeBins`, so impact is limited to non-default/misconfigured deployments.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.21-2` - Patched in code: `&gt;= 2026.2.22` (planned next npm release)</p> <p>### Fix - Remove generic safe-bin fallback during allowlist evaluation. - Require explicit safe-bin profiles for `safeBins` entries. - Add configurable `tools.exec.safeBinProfiles` (global + per-agent) for safe custom binaries. - Update docs to clearly separate `safeBins` from command allowlist semantics.</p> <p>### Fix Commit(s) - `47c3f742b6c488be26dd7b9636dbbb8676089154`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`&gt;= 2026.2.22`) so once that npm release is published, the advisory can be published directly without further metadata edits.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute inline payloads via flags like `-c`.</p> <p>This requires explicit operator configuration to add such binaries to `safeBins`, so impact is limited to non-default/misconfigured deployments.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.21-2` - Patched in code: `&gt;= 2026.2.22` (planned next npm release)</p> <p>### Fix - Remove generic safe-bin fallback during allowlist evaluation. - Require explicit safe-bin profiles for `safeBins` entries. - Add configurable `tools.exec.safeBinProfiles` (global + per-agent) for safe custom binaries. - Update docs to clearly separate `safeBins` from command allowlist semantics.</p> <p>### Fix Commit(s) - `47c3f742b6c488be26dd7b9636dbbb8676089154`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`&gt;= 2026.2.22`) so once that npm release is published, the advisory can be published directly without further metadata edits.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/brew-openclaw-cli-ghsa-8mf7-vv8w-hjr2