GHSA-4564-pvr2-qq4h: OpenClaw: Prevent shell injection in macOS keychain credential write
On macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk.
The fix avoids invoking a shell by using execFileSync("security", argv) and passing the updated keychain payload as a literal argument.
References
- github.com/advisories/GHSA-4564-pvr2-qq4h
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/66d7178f2d6f9d60abad35797f97f3e61389b70c
- github.com/openclaw/openclaw/commit/9dce3d8bf83f13c067bc3c32291643d2f1f10a06
- github.com/openclaw/openclaw/commit/b908388245764fb3586859f44d1dff5372b19caf
- github.com/openclaw/openclaw/pull/15924
- github.com/openclaw/openclaw/releases/tag/v2026.2.14
- github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4h
Code Behaviors & Features
Detect and mitigate GHSA-4564-pvr2-qq4h with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →