CVE-2026-31992

CVE-2026-31992 · OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

CVSS 7.1 · Alta · EPSS 0,3% · Corrección disponible

Publicación

2026-03-19T01:00:51.216Z

Actualización

2026-06-23T16:14:21.247Z

Pila tecnológica: node

Comprueba tu servidor →