CVE-2026-28363
CVE-2026-28363
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.
CVSS 9.9 · Crítica · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node