GHSA-3hcm-ggvf-rch5: OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

February 17, 2026

Exec approvals allowlist bypass via command substitution/backticks inside double quotes.

References

github.com/advisories/GHSA-3hcm-ggvf-rch5
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/d1ecb46076145deb188abcba8f0699709ea17198
github.com/openclaw/openclaw/releases/tag/v2026.2.2
github.com/openclaw/openclaw/security/advisories/GHSA-3hcm-ggvf-rch5

Code Behaviors & Features

Detect and mitigate GHSA-3hcm-ggvf-rch5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →