CVE-2026-31992

Katalog CVE

CVSS 8.8 · High EPSS 0,62%

Kerentanan Incomplete List of Disallowed Inputs pada openclaw. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-48wf-g7cp-gr3m mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/3f923e831364d83d0f23499ee49961de334cf58b patch
• https://github.com/openclaw/openclaw/commit/a1c4bf07c6baad3ef87a0e710fe9aef127b1f606 patch
• https://www.vulncheck.com/advisories/openclaw-allowlist-exec-guard-bypass-via-env-s advisory pihak ketiga