CVE-2026-31992
CVE-2026-31992 · OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-48wf-g7cp-gr3m
- https://github.com/openclaw/openclaw/commit/a1c4bf07c6baad3ef87a0e710fe9aef127b1f606
- https://github.com/openclaw/openclaw/commit/3f923e831364d83d0f23499ee49961de334cf58b
- https://www.vulncheck.com/advisories/openclaw-allowlist-exec-guard-bypass-via-env-s
- https://nvd.nist.gov/vuln/detail/CVE-2026-31992