GHSA-mhq8-78pj-5j79
HIGHGHSA-mhq8-78pj-5j79 is a high-severity (CVSS 7.1) CWE-367 vulnerability in openclaw. O3 Security confirms whether GHSA-mhq8-78pj-5j79 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.
openclawnpmDescription
Summary
On POSIX nodes, OpenClaw's system.run safe-bin checks could approve a command before shell expansion changed how the command was interpreted. A value that appeared to be a safe-bin argument could expand into additional shell words and become a file operand.
This issue is limited to paired POSIX node execution through system.run with safe-bin or allowlist-style auto-approval. It is not an unauthenticated node takeover.
Affected configurations
This affects deployments where:
- a POSIX node is paired to the gateway
system.runis reachable by an authenticated operator or agent flow- exec policy uses safe-bin or allowlist-based auto-approval
- the approved command contains shell-expanded values that can change argv shape
Impact
A lower-privilege operator flow could cause an approved safe-bin command to read a node-local file that was not intended by the policy. Depending on the local files available to the node process, this could expose OpenClaw configuration data or other node-local information.
The issue is a policy-enforcement gap in argv validation, not a general statement that every safe-bin command is unsafe.
Patched Versions
The first stable patched version is 2026.5.18.
Mitigations
Upgrade to [email protected] or later. Before upgrading, avoid broad safe-bin auto-approval for commands that can read arbitrary paths, and prefer explicit approval for node commands that touch local files.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | openclaw | all versions | 2026.5.18 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update openclaw to 2026.5.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mhq8-78pj-5j79 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-mhq8-78pj-5j79 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-mhq8-78pj-5j79. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-mhq8-78pj-5j79 in your dependencies?
O3 detects GHSA-mhq8-78pj-5j79 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.