1  info:
 2    name: OpenClaw
 3    cve: GHSA-g75x-8qqm-2vxp
 4    summary: OpenClaw `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks
 5    details: >-
 6      Summary
 7  
 8  
 9      tools.exec.safeBins allowlist checks could be bypassed by PATH-hijacked binaries, allowing execution of attacker-controlled
10      trojan binaries under an allowlisted executable name.
11  
12  
13      Affected Packages / Versions
14  
15  
16      - Package: openclaw (npm)
17  
18      - Latest published version at triage time: 2026.2.17
19  
20      - Affected range: >= 2026.1.21 < 2026.2.18
21  
22      - Patched version: 2026.2.19
23  
24  
25      Impact
26  
27  
28      In allowlist mode, safeBins validation previously accepted a resolved executable path based on executable name and argument
29      shape, without enforcing trusted executable directories. If an attacker could influence process PATH resolution before
30      gateway startup (or otherwise control the gateway launch environment), a trojan binary with an allowlisted name (for example
31      jq) could be executed.
32  
33  
34      Severity Rationale
35  
36  
37      This issue is rated medium because exploitation requires an additional precondition: influencing the gateway process PATH
38      / launch environment. Request-scoped PATH injection is blocked for host execution.
39  
40  
41      Fix
42  
43  
44      safeBins now requires the resolved executable path to come from trusted bin directories (system defaults plus gateway
45      startup PATH), closing the bypass.
46    cvss: ''
47    severity: MEDIUM
48    security_advise: Upgrade openclaw to >= 2026.2.19 or later. safeBins now requires the resolved executable path to come from
49      trusted bin directories (system defaults plus gateway startup PATH), closing the bypass.
50    references:
51    - https://github.com/openclaw/openclaw/security/advisories/GHSA-g75x-8qqm-2vxp
52  rule: version >= "2026.1.21" && version < "2026.2.18"
53  references:
54  - https://github.com/openclaw/openclaw/security/advisories/GHSA-g75x-8qqm-2vxp