https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:33:15 +0000 https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-41368 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>The jq safe-bin policy blocked explicit `env` usage but still allowed jq programs that accessed environment data through `$ENV`.</p> <p>## Impact</p> <p>An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.</p> <p>## Affected Component</p> <p>`src/infra/exec-safe-bin-semantics.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `78e2f3d66d` (`Exec: tighten jq safe-bin env checks`).</p> <p>Thanks @nicky-cc of Tencent zhuque Lab ([https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)) for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>The jq safe-bin policy blocked explicit `env` usage but still allowed jq programs that accessed environment data through `$ENV`.</p> <p>## Impact</p> <p>An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.</p> <p>## Affected Component</p> <p>`src/infra/exec-safe-bin-semantics.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `78e2f3d66d` (`Exec: tighten jq safe-bin env checks`).</p> <p>Thanks @nicky-cc of Tencent zhuque Lab ([https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)) for reporting.</p> https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-41368