CVE-2026-29608

脆弱性の種類

OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.

影響を受ける製品

• openclaw openclaw

参考情報

• https://github.com/openclaw/openclaw/commit/dded569626b0d8e7bdab10b5e7528b6caf73a0f1
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h3rm-6x7g-882f
• https://www.vulncheck.com/advisories/openclaw-approval-integrity-bypass-via-system-run-argv-rewriting