https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 18:57:44 +0000 https://vulnerability.circl.lu/vuln/ghsa-7ff8-xjh3-mgh6 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval configuration could allow a skill-name collision to bypass an `ask=on-miss` prompt.</p> <p>When `autoAllowSkills=true`, a path-scoped executable such as `./skill-bin` could resolve to basename `skill-bin`, satisfy the `skills` allowlist segment, and run without prompting for approval.</p> <p>### Affected Packages / Versions - Package: `npm openclaw` - Affected versions: `&lt;= 2026.2.22-2` - Patched versions: `&gt;= 2026.2.23` (released)</p> <p>### Configuration Scope (Not Default) This behavior requires non-default settings and does not affect default installs.</p> <p>Required conditions: - `autoAllowSkills=true` (default is `false`) - `system.run` with `security=allowlist` - `ask=on-miss`</p> <p>### Technical Details The allowlist evaluator accepted `skills` satisfaction by bin-name match, so `./skill-bin` could match `skillBins.has(&#34;skill-bin&#34;)` after resolution.</p> <p>The fix hardens skill auto-allow matching by requiring: - a pathless invocation token (no `/` or `\\`), and - a trusted resolved executable path for that skill bin on the machine where skills run.</p> <p>This preserves normal `skill-bin ...` behavior while preventing `./&lt;skill-bin&gt;` and absolute-path basename collisions from auto-satisfying `skills`.</p> <p>### Impact In affected non-default configurations, approval prompts could be skipped for commands that should have required operator confirmation.</p> <p>### Fix Commit(s) - `ffd63b7a2c4c6d5aeb4710ef951d5794ad7ad77b…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval configuration could allow a skill-name collision to bypass an `ask=on-miss` prompt.</p> <p>When `autoAllowSkills=true`, a path-scoped executable such as `./skill-bin` could resolve to basename `skill-bin`, satisfy the `skills` allowlist segment, and run without prompting for approval.</p> <p>### Affected Packages / Versions - Package: `npm openclaw` - Affected versions: `&lt;= 2026.2.22-2` - Patched versions: `&gt;= 2026.2.23` (released)</p> <p>### Configuration Scope (Not Default) This behavior requires non-default settings and does not affect default installs.</p> <p>Required conditions: - `autoAllowSkills=true` (default is `false`) - `system.run` with `security=allowlist` - `ask=on-miss`</p> <p>### Technical Details The allowlist evaluator accepted `skills` satisfaction by bin-name match, so `./skill-bin` could match `skillBins.has(&#34;skill-bin&#34;)` after resolution.</p> <p>The fix hardens skill auto-allow matching by requiring: - a pathless invocation token (no `/` or `\\`), and - a trusted resolved executable path for that skill bin on the machine where skills run.</p> <p>This preserves normal `skill-bin ...` behavior while preventing `./&lt;skill-bin&gt;` and absolute-path basename collisions from auto-satisfying `skills`.</p> <p>### Impact In affected non-default configurations, approval prompts could be skipped for commands that should have required operator confirmation.</p> <p>### Fix Commit(s) - `ffd63b7a2c4c6d5aeb4710ef951d5794ad7ad77b…</p> https://vulnerability.circl.lu/vuln/ghsa-7ff8-xjh3-mgh6