Iniciar sesión
Deutsch English Español Polski
Media

OpenClaw: pnpm dlx approvals did not bind local script operands

  • Publicada: 07.04.2026
  • Actualizado: 11.10.2026 10:22

Summary

Before OpenClaw 2026.4.2, pnpm dlx approval planning did not bind local script operands the same way as related pnpm exec flows. A local script approved through a pnpm dlx path could be replaced before execution without invalidating the approval.

Impact

An operator could approve a benign local script and then execute modified script contents through the still-valid approval plan. This was an approval-integrity bug in the node-host command-planning path.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.4.1
  • Patched versions: >= 2026.4.2
  • Latest published npm version: 2026.4.1

Fix Commit(s)

  • 176c059b05357df1bc09d4328a2380670859eeff — bind local scripts in pnpm dlx approval plans

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @Kazamayc for reporting.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm openclaw < 2026.4.2 2026.4.2

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Debilidad (CWE)
CWE-863
Plataforma
npm
Paquete
openclaw
Publicada
07.04.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-w6wx-jq6j-6mcj - CC BY 4.0

Historial de vulnerabilidades: openclaw

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (588) en el archivo
Entradas en total
588
Primera → última
02.2026 07.2026
Sin corrección
9
Explotada en ataques
0

Distribución por gravedad

  • Crítica 20
  • Alta 215
  • Media 299
  • Baja 54

Divulgaciones por año

Gravedad:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    Alta CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Alta · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Alta CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Alta CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    Alta · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Alta · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Alta · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    Alta · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Alta · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Alta · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Alta · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Crítica CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Alta · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    Alta CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Alta · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Alta · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Alta · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Alta · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Alta · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Alta · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Alta · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Alta · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    Alta CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    Alta · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    Alta · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Alta · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Alta · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Alta · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Alta · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Alta · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Alta · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Alta · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Alta · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Alta · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Alta · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Alta · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Alta · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Alta · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Alta · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  42. OpenClaw: Feishu webhook and card-action validation now fail closed
    Crítica · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  43. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Crítica · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  44. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Alta CVE-2026-43533 < 2026.4.10 2026.4.10
  45. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Alta · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  46. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Alta · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  47. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Alta · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  48. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Alta · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  49. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Alta CVE-2026-43581 < 2026.4.10 2026.4.10
  50. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Alta · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  51. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Alta · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  52. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Alta · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  53. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Alta CVE-2026-43528 < 2026.4.14 2026.4.14
  54. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Alta CVE-2026-40037 < 2026.4.8 2026.4.8
  55. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Alta · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  56. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Alta CVE-2026-42427 < 2026.4.8 2026.4.8
  57. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Alta ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  58. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Alta ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  59. OpenClaw: pnpm dlx approvals did not bind local script operands esta entrada
    Media CVE-2026-41360 < 2026.4.2 2026.4.2
  60. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Alta · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  61. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Alta · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  62. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    Alta CVE-2026-34511 < 2026.4.2 2026.4.2
  63. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    Alta CVE-2026-41393 < 2026.3.31 2026.3.31
  64. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    Alta · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  65. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    Alta CVE-2026-41353 < 2026.3.22 2026.3.22
  66. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    Alta · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  67. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Crítica · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  68. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    Alta · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  69. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    Alta CVE-2026-41404 < 2026.3.31 2026.3.31
  70. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    Alta CVE-2026-41349 < 2026.3.28 2026.3.28
  71. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    Alta · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  72. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    Alta · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  73. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    Alta · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  74. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    Alta CVE-2026-41366 < 2026.3.31 2026.3.31
  75. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    Alta · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  76. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    Alta · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  77. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    Alta · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  78. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    Alta · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  79. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Crítica CVE-2026-41329 < 2026.3.31 2026.3.31
  80. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    Alta · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
Mostrar más (20) Mostrando 80 de 236

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.