Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · OpenClaw

CVE-2026-28363: OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode

criticalCVSS 3.1 9.9GHSA-7977-c43c-xpwj

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.

Published Feb 27, 2026 · Updated Feb 28, 2026

Affected packages

openclaw

Ecosystem
npm
Affected
< 2026.2.23
Fixed in
2026.2.23
Check
npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries