GHSA-j425-whc4-4jgc: OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

March 9, 2026

system.run env override sanitization allowed dangerous override-only helper-command pivots to reach subprocesses. A caller who could invoke system.run with env overrides could bypass allowlist/approval intent by steering an allowlisted tool through helper-command or config-loading environment variables such as GIT_SSH_COMMAND, editor/pager hooks, and GIT_CONFIG_* / NPM_CONFIG_*.

References

github.com/advisories/GHSA-j425-whc4-4jgc
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/e27bbe4982439da6864160fd1b66445058f74801
github.com/openclaw/openclaw/releases/tag/v2026.3.7
github.com/openclaw/openclaw/security/advisories/GHSA-j425-whc4-4jgc

Code Behaviors & Features

Detect and mitigate GHSA-j425-whc4-4jgc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →