GHSA-vmqr-rc7x-3446: OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints

March 3, 2026

When sort is explicitly added to tools.exec.safeBins (non-default), the --compress-program option can invoke an external helper and bypass the intended safe-bin approval constraints in allowlist mode.

References

github.com/advisories/GHSA-vmqr-rc7x-3446
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/57fbbaebca4d34d17549accf6092ae26eb7b605c
github.com/openclaw/openclaw/security/advisories/GHSA-vmqr-rc7x-3446

Code Behaviors & Features

Detect and mitigate GHSA-vmqr-rc7x-3446 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →