← CVE Intelligence

CVE-2026-28363

OpenClaw / OpenClaw PUBLISHED

Description (CNA)

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.

Affected (CNA)

Vendor / productVersions
OpenClaw / OpenClawaffected 0 before 2026.2.23

CWE

CWE-184

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.