GHSA-q399-23r3-hfx4: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind

March 2, 2026

For host=node runs, approvals validated command context but did not pin executable identity for non-path-like argv[0] tokens (for example tr). If PATH resolution changed after approval, execution could run a different binary.

References

github.com/advisories/GHSA-q399-23r3-hfx4
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-q399-23r3-hfx4

Code Behaviors & Features

Detect and mitigate GHSA-q399-23r3-hfx4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →