This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: OpenClaw (pre-2026.2.23) has a critical flaw in `tools.exec.safeBins`. <br>๐ฅ **Consequences**: Attackers can bypass safety checks. This leads to **unauthorized code execution**.โฆ
๐ก๏ธ **Root Cause**: **CWE-184** (Incomplete List of Disallowed Inputs). <br>๐ **Flaw**: The validation logic for `safeBins` is insufficient. It fails to block malicious inputs effectively, allowing bypass.
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: **OpenClaw** by vendor OpenClaw. <br>๐ **Versions**: All versions **before 2026.2.23**. <br>โ ๏ธ **Component**: The `tools.exec` module specifically.
Q4What can hackers do? (Privileges/Data)
๐ **Privileges**: High Impact. CVSS Score indicates **High** Confidentiality, Integrity, and Availability impact. <br>๐ **Data**: Attackers can execute arbitrary code.โฆ
๐ **Threshold**: **Low**. <br>๐ **Config**: CVSS `PR:L` (Low Privileges) required. `AV:N` (Network) and `UI:N` (No User Interaction). <br>๐ **Ease**: `AC:L` (Low Complexity). Easy to exploit if network access exists.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ต๏ธ **Public Exp?**: **No**. <br>๐ **PoC**: The `pocs` field is empty. <br>๐ **Wild Exp**: No reports of wild exploitation yet. However, the low complexity makes it a prime target.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Check your OpenClaw version. <br>๐ **Scan**: Look for versions **< 2026.2.23**. <br>๐ ๏ธ **Feature**: Inspect `tools.exec.safeBins` configuration. Ensure strict input validation is in place.
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed?**: **Yes**. <br>๐ฉน **Patch**: Update to **OpenClaw 2026.2.23** or later. <br>๐ข **Source**: See GitHub Advisory GHSA-3c6h-g97w-fg78 for official details.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Implement strict **Input Validation**. <br>๐ **Workaround**: Restrict `safeBins` to a known-good whitelist. Disable `tools.exec` if not needed. Apply network segmentation.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: **Critical**. <br>๐จ **Priority**: Patch immediately. <br>โณ **Reason**: CVSS is High. Network-accessible. Low exploitation barrier. Do not wait for PoC.