{"id":"CVE-2026-29608","aliases":["EUVD-2026-13016","GHSA-g87j-gm7p-6vw2","GHSA-h3rm-6x7g-882f"],"status":"published","title":"OpenClaw 2026.3.1 \u003c 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting","description":"OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00138,"percentile":0.03262,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-88"],"published":"2026-03-03T21:19:08Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2026.3.1"},{"last_affected":"2026.3.1"},{"fixed":"2026.3.2"}]}],"versions":["2026.3.1"]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"2026.3.1"},{"fixed":"2026.3.2"}]}],"versions":["2026.3.1"]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h3rm-6x7g-882f","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/commit/dded569626b0d8e7bdab10b5e7528b6caf73a0f1","tags":["patch","Patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/openclaw-approval-integrity-bypass-via-system-run-argv-rewriting","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29608","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g87j-gm7p-6vw2"},{"url":"https://github.com/advisories/GHSA-h3rm-6x7g-882f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29608.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-29608","title":"OpenClaw 2026.3.1 \u003c 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting","description":"OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.","status":"published","published":"2026-03-19T01:00:48.321Z","modified":"2026-06-23T16:14:18.525Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-13016","description":"OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.","status":"published","published":"2026-03-19T01:00:48Z","modified":"2026-06-23T16:14:18Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-g87j-gm7p-6vw2","title":"Duplicate Advisory: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-h3rm-6x7g-882f. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.","status":"withdrawn","published":"2026-03-19T03:30:57Z","modified":"2026-03-19T16:26:08Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:39:37.554665Z"},{"id":"GHSA-h3rm-6x7g-882f","title":"OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts","description":"### Summary\nIn `openclaw@2026.3.1`, node `system.run` approval-path hardening rewrote wrapper command argv in a way that changed execution semantics. A command shown/approved as a shell payload (for example `echo SAFE`) could execute a different local script when wrapper argv were rewritten.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `2026.3.1` (latest published npm version as of March 2, 2026)\n- Fixed release: `2026.3.2` (released)\n\n### Technical Details\nRoot cause was in node-host approval hardening for `system.run`:\n- `src/node-host/invoke-system-run-plan.ts` rewrote `argv[0]` to the resolved executable.\n- Wrapper resolution unwrapped dispatch wrappers, so input like `['env','sh','-c','echo SAFE']` resolved executable `sh`.\n- The approved plan could become `['/bin/sh','sh','-c','echo SAFE']` while approval text remained `echo SAFE`.\n\nThat rewrite changed runtime behavior: `/bin/sh` interprets the extra `sh` positional argument as a script path, enabling execution of a local `./sh` file from approved `cwd` instead of the approved payload text.\n\n### Impact\nApproval-integrity break in `host=node` execution flow: operator-visible command text and executed behavior could diverge.\n\nExploit preconditions:\n- attacker can influence wrapper argv and place a local file in approved working directory,\n- operator grants approval for the displayed command.\n\n### Fix Commit(s)\n- `dded569626b0d8e7bdab10b5e7528b6caf73a0f1`\n\n### Fixed Version\n- Patched in `openclaw@2026.3.2`.","status":"published","published":"2026-03-03T21:19:08Z","modified":"2026-03-19T21:22:06Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:39:38.524712Z"}],"nvd":[{"id":"CVE-2026-29608","description":"OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.","status":"published","published":"2026-03-19T02:16:03.223Z","modified":"2026-06-17T10:29:49.23Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-29608","title":"OpenClaw 2026.3.1 \u003c 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting","description":"OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.","status":"published","published":"2026-03-19T01:00:48.321Z","modified":"2026-10-28T02:30:22.768092537Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-g87j-gm7p-6vw2","title":"Duplicate Advisory: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-h3rm-6x7g-882f. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.","status":"withdrawn","published":"2026-03-19T03:30:57Z","modified":"2026-03-19T16:31:31.142129Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"},{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GHSA-h3rm-6x7g-882f","title":"OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts","description":"### Summary\nIn `openclaw@2026.3.1`, node `system.run` approval-path hardening rewrote wrapper command argv in a way that changed execution semantics. A command shown/approved as a shell payload (for example `echo SAFE`) could execute a different local script when wrapper argv were rewritten.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `2026.3.1` (latest published npm version as of March 2, 2026)\n- Fixed release: `2026.3.2` (released)\n\n### Technical Details\nRoot cause was in node-host approval hardening for `system.run`:\n- `src/node-host/invoke-system-run-plan.ts` rewrote `argv[0]` to the resolved executable.\n- Wrapper resolution unwrapped dispatch wrappers, so input like `['env','sh','-c','echo SAFE']` resolved executable `sh`.\n- The approved plan could become `['/bin/sh','sh','-c','echo SAFE']` while approval text remained `echo SAFE`.\n\nThat rewrite changed runtime behavior: `/bin/sh` interprets the extra `sh` positional argument as a script path, enabling execution of a local `./sh` file from approved `cwd` instead of the approved payload text.\n\n### Impact\nApproval-integrity break in `host=node` execution flow: operator-visible command text and executed behavior could diverge.\n\nExploit preconditions:\n- attacker can influence wrapper argv and place a local file in approved working directory,\n- operator grants approval for the displayed command.\n\n### Fix Commit(s)\n- `dded569626b0d8e7bdab10b5e7528b6caf73a0f1`\n\n### Fixed Version\n- Patched in `openclaw@2026.3.2`.","status":"published","published":"2026-03-03T21:19:08Z","modified":"2026-03-19T21:41:21.144916Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:46:48.546324Z"}]}}