BREW-OPENCLAW-CLI-CVE-20… (GHSA-5V6X-RFC3-7QFR)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:21 – Updated: 2026-09-25 08:57 – Source website
VLAI
Summary
OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments
Details

Summary

A Windows system.run approval-integrity mismatch in the cmd.exe /c path could allow trailing arguments to execute while approval/audit text reflected only a benign command string.

This requires an authenticated operator context using the approvals flow and a trusted Windows node.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published vulnerable version (as of 2026-02-21): 2026.2.19-2
  • Vulnerable range: <=2026.2.19-2
  • Patched version (planned next release): 2026.2.21

Attack Scenario

  1. An authenticated operator approval is created for a benign command text (for example, echo).
  2. A system.run request uses cmd.exe /c with extra trailing arguments.
  3. Prior behavior could bind approval/audit text to the benign command while still executing the full argument tail on the node.

Impact

  • Local command execution on the trusted Windows node process account.
  • Approval/audit command text integrity mismatch.

Fix

  • Canonicalize the full command tail after cmd.exe /c.
  • Reuse one shared command canonicalization/validation path for validation, approval matching, and execution/audit text.
  • Add regression coverage for trailing-argument smuggling and approval binding.

Fix Commit(s)

  • 6007941f04df1edcca679dd6c95949744fdbd4df

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21). Once that npm release is live, this advisory can be published directly.

OpenClaw thanks @tdjackey for reporting.

Severity
8.5 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "2026.2.21"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "openclaw-cli",
        "purl": "pkg:brew/openclaw-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/openclaw@2026.9.6",
        "name": "openclaw",
        "strategy": "registry",
        "subject_version": "2026.9.6"
      }
    ]
  },
  "details": "### Summary\nA Windows `system.run` approval-integrity mismatch in the `cmd.exe /c` path could allow trailing arguments to execute while approval/audit text reflected only a benign command string.\n\nThis requires an authenticated operator context using the approvals flow and a trusted Windows node.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published vulnerable version (as of 2026-02-21): `2026.2.19-2`\n- Vulnerable range: `\u003c=2026.2.19-2`\n- Patched version (planned next release): `2026.2.21`\n\n### Attack Scenario\n1. An authenticated operator approval is created for a benign command text (for example, `echo`).\n2. A `system.run` request uses `cmd.exe /c` with extra trailing arguments.\n3. Prior behavior could bind approval/audit text to the benign command while still executing the full argument tail on the node.\n\n### Impact\n- Local command execution on the trusted Windows node process account.\n- Approval/audit command text integrity mismatch.\n\n### Fix\n- Canonicalize the full command tail after `cmd.exe /c`.\n- Reuse one shared command canonicalization/validation path for validation, approval matching, and execution/audit text.\n- Add regression coverage for trailing-argument smuggling and approval binding.\n\n### Fix Commit(s)\n- `6007941f04df1edcca679dd6c95949744fdbd4df`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is live, this advisory can be published directly.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "BREW-openclaw-cli-CVE-2026-22168",
  "modified": "2026-09-25T08:57:16Z",
  "published": "2026-08-13T17:21:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5v6x-rfc3-7qfr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/6007941f04df1edcca679dd6c95949744fdbd4df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-command-injection-via-cmd-exe-c-trailing-arguments-in-system-run"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments",
  "upstream": [
    "GHSA-5v6x-rfc3-7qfr",
    "CVE-2026-22168"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.