CVE-2026-32978: OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
(updated )
In affected versions of openclaw, node-host system.run approvals did not bind a mutable file operand for some script runners, including forms such as tsx and jiti. An attacker could obtain approval for a benign script-runner command, rewrite the referenced script on disk, and have the modified code execute under the already approved run context.
References
- github.com/advisories/GHSA-qc36-x95h-7j53
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/releases/tag/v2026.3.11
- github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53
- nvd.nist.gov/vuln/detail/CVE-2026-32978
- www.vulncheck.com/advisories/openclaw-approval-bypass-via-unrecognized-script-runners
Code Behaviors & Features
Detect and mitigate CVE-2026-32978 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →