GHSA-ff98-w8hj-qrxf
GHSA-ff98-w8hj-qrxf · OpenClaw plugin runtime command execution is part of trusted plugin boundary
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
### Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`). ### Impact Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version reviewed: `2026.2.17` - Affected range for this advisory record: `<= 2026.2.17` - Planned patched version metadata: `2026.2.19` (next release line) ### Fix Commit(s) - `2e421f32dfc589c02706265fd3c3137ffc06c4b1` ### Remediation - Install only trusted plugins. - Use `plugins.allow` to pin explicit trusted plugin IDs. - SECURITY.md now explicitly documents that plugin runtime helpers are convenience APIs, not a sandbox boundary. OpenClaw thanks @markmusson for reporting.
CVSS 6.9 · Mittel · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: node
Betroffene Produkte und Versionen
openclaw npm
- Betroffene Versionsbereiche
- SEMVER: < 2026.2.19
Auf 2026.2.19 aktualisieren