| Title | OpenClaw openclaw <= 2026.5.10-beta.1 Incomplete List of Disallowed Inputs (CWE-184) |
|---|
| Description | # Technical Details
A shell wrapper inline-command parsing bypass exists in OpenClaw's exec approval allowlist enforcement.
The allowlist logic in `src/infra/exec-approvals-allowlist.ts` attempts to extract shell-wrapper payloads before matching an executable allowlist. The CMD parser in `src/infra/shell-wrapper-resolution.ts` recognizes `/c` and `/k`, but does not recognize `-c` or `-k`. As a result, `cmd.exe -c <payload>` can be treated as an allowlisted wrapper invocation instead of an inline shell command that requires deeper inspection. The same parsing area also has incomplete PowerShell alias handling for forms such as `pwsh -ec`.
# Vulnerable Code
File: src/infra/exec-approvals-allowlist.ts
Method: resolveSegmentAllowlistMatch
Why: If shell payload extraction fails, the matcher can compare only the wrapper executable against the allowlist.
File: src/infra/shell-wrapper-resolution.ts
Method: extractCmdInlineCommand
Why: The parser checks for `/c` and `/k`, but misses `-c` and `-k`, leaving valid command-bearing CMD invocations unclassified.
File: src/infra/system-run-command.ts
Method: shell payload display and command analysis
Why: The preview and consistency layer depends on the same parser result, so missing extraction also hides the actual embedded command from display logic.
# Reproduction
1. Configure an affected OpenClaw deployment with exec approvals in allowlist mode.
2. Add `cmd.exe` or `cmd` to the effective executable allowlist.
3. Run a local proof of concept that evaluates an argv command such as `cmd.exe -c echo pwned`.
4. Observe that policy blocking is false, allowlist satisfaction is true, and the detected shell payload is null.
5. Compare with recognized forms such as `cmd.exe /c <payload>`, which should be treated as inline shell execution.
# Impact
- Command-execution policy bypass when CMD is allowlisted.
- Arbitrary inline shell payload execution without the intended approval gate.
- Loss of visibility in approval and preview logic for the real command being executed.
- Potential disclosure or modification of host files, source code, tokens, credentials, CI material, and other assets accessible to the OpenClaw process.
Reference Link: https://gist.github.com/YLChen-007/8563426c457089620731d58b90fd94c4 ; |
|---|
| Source | ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-f397-5vjw-v2c2 |
|---|
| User | AbamaYouLong (UID 99186) |
|---|
| Submission | 07/01/2026 09:11 (2 months ago) |
|---|
| Moderation | 08/17/2026 11:47 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 371430 [OpenClaw up to 2026.5.11 authorization] |
|---|
| Points | 0 |
|---|