What is GHSA-gwcq-453v-2frr?

GHSA-gwcq-453v-2frr is a security advisory published by GitHub Security Advisories with High severity. Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

Why does GHSA-gwcq-453v-2frr have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-gwcq-453v-2frr?

GHSA-gwcq-453v-2frr has a CVSS v3 base score of 8.3, published by GitHub Security Advisories.

Which products are affected by GHSA-gwcq-453v-2frr?

GHSA-gwcq-453v-2frr affects 1 product, including: npm/openclaw:\u003c 2026.5.18.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: August 25, 2026

GHSA-gwcq-453v-2frrHighCVSS 8.3Disclosed before NVD

Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

Vendor

GitHub Security Advisories

Published

June 13, 2026

Last Modified

August 25, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mhq8-78pj-5j79. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

🎯 Affected products1

npm/openclaw:< 2026.5.18

🔗 References (4)

https://github.com/openclaw/openclaw/security/advisories/GHSA-mhq8-78pj-5j79
https://nvd.nist.gov/vuln/detail/CVE-2026-53831
https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-shell-expansion-in-system-run-safe-bin-allowlist
https://github.com/advisories/GHSA-gwcq-453v-2frr