Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-hjvp-qhm6-wrh2

LowCVSS 2.6 / 10
Published Mar 2, 2026·Last modified Mar 30, 2026
Affected Components(0)

No affected components available

Description

Summary

In approval-enabled host=node workflows, system.run approvals did not always carry a strict, versioned execution-context binding. In uncommon setups that rely on these approvals as an integrity guardrail, a previously approved request could be reused with changed env input.

Affected Packages / Versions

  • Package: npm openclaw
  • Latest published npm version at triage: 2026.2.25
  • Affected range: <= 2026.2.25
  • Planned fixed version (next npm release): 2026.2.26

Preconditions / Typical Exposure

This requires all of the following:

  • system.run usage through host=node
  • Exec approvals enabled and used as an execution-integrity control
  • Access to an approval id in the same context

Most default single-operator local setups do not rely on this path, so practical exposure is typically lower.

Details

Approval matching now uses a required versioned binding (systemRunBindingV1) over command argv, cwd, agent/session context, and env hash.

The fix:

  • Requires commandArgv when requesting host=node approvals.
  • Requires systemRunBindingV1 when consuming approvals for node system.run.
  • Removes legacy non-versioned fallback matching and fails closed on missing/mismatched bindings.
  • Keeps env mismatch handling explicit and blocks GIT_EXTERNAL_DIFF in host env policy.
  • Adds/updates regression and contract coverage for mismatch mapping and binding rules.

Impact

Configuration-dependent approval-integrity weakness in node-host exec approval flows. Severity remains medium because exploitation depends on this specific approval mode and context.

Fix Commit(s)

  • 10481097f8e6dd0346db9be0b5f27570e1bdfcfa

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.26) so once npm release 2026.2.26 is published, the advisory can be published without further metadata edits.

OpenClaw thanks @tdjackey for reporting.

Risk Scores
Base Score
2.6

The vulnerability can be exploited over the network without needing physical access. It is difficult for an attacker to exploit this vulnerability and may require special conditions. An attacker needs basic access or low-level privileges. The attacker needs the user to perform some action, like clicking a link. The impact is confined to the system where the vulnerability exists. There is a low impact on the integrity of the data.

Threat Intelligence
2.4

Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.

EPSS
0.19%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Low severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard