CVE-2026-41392
OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options
Résumé
OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations. Attackers can exploit shell options like --rcfile, --init-file, and --startup-file to load attacker-chosen initialization files while bypassing exec allowlist matching restrictions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com