CVE-2026-29608

Katalog CVE

CVSS 6.7 · Medium EPSS 0,18%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada openclaw. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-h3rm-6x7g-882f advisory vendor
• https://github.com/openclaw/openclaw/commit/dded569626b0d8e7bdab10b5e7528b6caf73a0f1 patch
• https://www.vulncheck.com/advisories/openclaw-approval-integrity-bypass-via-system-run-argv-rewriting advisory pihak ketiga