GHSA-392f-ggf5-fp3c
GHSA-392f-ggf5-fp3c · OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
### Summary A paired node could supply Unicode-confusable `platform` or `deviceFamily` metadata that passed metadata pinning but classified differently for command policy resolution, broadening default node command allowlists. ### Impact This is a policy-bypass issue within the paired-node trust boundary and can expand node command availability beyond intended defaults. ### Fix Node metadata canonicalization was hardened against confusables, and unknown platform defaults were made conservative (excluding `system.run` and `system.which` unless explicitly allowlisted). ### Affected and Patched Versions - Affected: `<= 2026.2.26` - Patched: `2026.3.1`
CVSS 6.9 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
openclaw npm
- Plages de versions concernées
- SEMVER: < 2026.3.1
Mettez à jour vers 2026.3.1