GHSA-7f4q-9rqh-x36p: OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

March 3, 2026

On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries (for example echo) as trusted command matches. This could allow a same-name local binary (for example ./echo) to run without approval under security=allowlist + ask=on-miss.

References

github.com/advisories/GHSA-7f4q-9rqh-x36p
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/dd41fadcaf58fd9deb963d6e163c56161e7b35dd
github.com/openclaw/openclaw/security/advisories/GHSA-7f4q-9rqh-x36p

Code Behaviors & Features

Detect and mitigate GHSA-7f4q-9rqh-x36p with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →