{"id":"CVE-2026-32978","aliases":["EUVD-2026-17016","GHSA-qc36-x95h-7j53"],"status":"published","title":"OpenClaw \u003c 2026.3.11 - Approval Bypass via Unrecognized Script Runners","description":"OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00182,"percentile":0.07869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-03-13T15:48:05Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.3.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.3.11"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.3.11"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53","tags":["vendor-advisory","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-unrecognized-script-runners","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/releases/tag/v2026.3.11","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32978","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qc36-x95h-7j53"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32978.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-32978","title":"OpenClaw \u003c 2026.3.11 - Approval Bypass via Unrecognized Script Runners","description":"OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.","status":"published","published":"2026-03-29T12:44:27.571Z","modified":"2026-06-23T16:15:28.855Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-17016","description":"OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.","status":"published","published":"2026-03-29T12:44:27Z","modified":"2026-06-23T16:15:28Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T18:20:32.273921Z"}],"ghsa":[{"id":"GHSA-qc36-x95h-7j53","title":"OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity","description":"## Summary\nIn affected versions of `openclaw`, node-host `system.run` approvals did not bind a mutable file operand for some script runners, including forms such as `tsx` and `jiti`. An attacker could obtain approval for a benign script-runner command, rewrite the referenced script on disk, and have the modified code execute under the already approved run context.\n\n## Impact\nDeployments that rely on node-host `system.run` approvals for script integrity could execute rewritten local code after operator approval. This can lead to unintended local code execution as the OpenClaw runtime user.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c 2026.3.11`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe approval planner only tracked mutable script operands for a hardcoded set of interpreters and runtime forms. Commands such as `tsx ./run.ts` and `jiti ./run.ts` fell through without a bound file snapshot, so the final pre-execution revalidation step was skipped.\n\n## Fix\nOpenClaw now fails closed for approval-backed interpreter and runtime commands unless it can bind exactly one concrete local file operand, and it extends direct-file binding coverage for additional runtime forms. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.","status":"published","published":"2026-03-13T15:48:05Z","modified":"2026-04-06T22:35:58Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:39:48.966685Z"}],"nvd":[{"id":"CVE-2026-32978","description":"OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.","status":"published","published":"2026-03-29T13:17:01.963Z","modified":"2026-06-17T10:36:40.83Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-32978","title":"OpenClaw \u003c 2026.3.11 - Approval Bypass via Unrecognized Script Runners","description":"OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.","status":"published","published":"2026-03-29T12:44:27.571Z","modified":"2026-10-28T02:30:46.332267119Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"GHSA-qc36-x95h-7j53","title":"OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity","description":"## Summary\nIn affected versions of `openclaw`, node-host `system.run` approvals did not bind a mutable file operand for some script runners, including forms such as `tsx` and `jiti`. An attacker could obtain approval for a benign script-runner command, rewrite the referenced script on disk, and have the modified code execute under the already approved run context.\n\n## Impact\nDeployments that rely on node-host `system.run` approvals for script integrity could execute rewritten local code after operator approval. This can lead to unintended local code execution as the OpenClaw runtime user.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c 2026.3.11`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe approval planner only tracked mutable script operands for a hardcoded set of interpreters and runtime forms. Commands such as `tsx ./run.ts` and `jiti ./run.ts` fell through without a bound file snapshot, so the final pre-execution revalidation step was skipped.\n\n## Fix\nOpenClaw now fails closed for approval-backed interpreter and runtime commands unless it can bind exactly one concrete local file operand, and it extends direct-file binding coverage for additional runtime forms. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.","status":"published","published":"2026-03-13T15:48:05Z","modified":"2026-04-06T22:56:23.724347Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}