GHSA-48wf-g7cp-gr3m: OpenClaw has allowlist exec-guard bypass via env -S

March 3, 2026

In allowlist mode, system.run guardrails could be bypassed through env -S, causing policy-analysis/runtime-execution mismatch for shell wrapper payloads.

References

github.com/advisories/GHSA-48wf-g7cp-gr3m
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/3f923e831364d83d0f23499ee49961de334cf58b
github.com/openclaw/openclaw/commit/a1c4bf07c6baad3ef87a0e710fe9aef127b1f606
github.com/openclaw/openclaw/security/advisories/GHSA-48wf-g7cp-gr3m

Code Behaviors & Features

Detect and mitigate GHSA-48wf-g7cp-gr3m with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →