GHSA-3c6h-g97w-fg78: OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

March 3, 2026

In OpenClaw, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations in allowlist mode, allowing approval-free execution paths that should require approval.

References

github.com/advisories/GHSA-3c6h-g97w-fg78
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f
github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78

Code Behaviors & Features

Detect and mitigate GHSA-3c6h-g97w-fg78 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →