GHSA-qhrr-grqp-6x2g: OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode

March 3, 2026

In openclaw allowlist mode, tools.exec.safeBins trusted PATH-derived directories for safe-bin resolution. A same-name binary placed in a trusted PATH directory could satisfy safe-bin checks and execute.

References

github.com/advisories/GHSA-qhrr-grqp-6x2g
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/64b273a71cf0b2f2419c974832cede1fc2158729
github.com/openclaw/openclaw/security/advisories/GHSA-qhrr-grqp-6x2g

Code Behaviors & Features

Detect and mitigate GHSA-qhrr-grqp-6x2g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →