CVE-2026-27487: OpenClaw: Prevent shell injection in macOS keychain credential write
(updated )
On macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk.
The fix avoids invoking a shell by using execFileSync("security", argv) and passing the updated keychain payload as a literal argument.
References
- github.com/advisories/GHSA-4564-pvr2-qq4h
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/66d7178f2d6f9d60abad35797f97f3e61389b70c
- github.com/openclaw/openclaw/commit/9dce3d8bf83f13c067bc3c32291643d2f1f10a06
- github.com/openclaw/openclaw/commit/b908388245764fb3586859f44d1dff5372b19caf
- github.com/openclaw/openclaw/pull/15924
- github.com/openclaw/openclaw/releases/tag/v2026.2.14
- github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4h
- nvd.nist.gov/vuln/detail/CVE-2026-27487
Code Behaviors & Features
Detect and mitigate CVE-2026-27487 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →