GHSA-p4wh-cr8m-gm6c: OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

March 3, 2026

shell-env fallback trusted prefix-based executable paths for $SHELL, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios.

References

github.com/advisories/GHSA-p4wh-cr8m-gm6c
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-p4wh-cr8m-gm6c

Code Behaviors & Features

Detect and mitigate GHSA-p4wh-cr8m-gm6c with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →