Answer in brief
CVE-2026-53831 records a High severity vulnerability in OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion. The current sources do not mark it as known exploited. The current feed maps openclaw (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps openclaw (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| openclawnpm | <2026.5.18 | 2026.5.18 |
Published upstream
Jul 2, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Aug 25, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Jul 2, 2026
### Summary On POSIX nodes, OpenClaw's `system.run` safe-bin checks could approve a command before shell expansion changed how the command was interpreted. A value that appeared to be a safe-bin argument could expand into additional shell words and become a file operand. This issue is limited to paired POSIX node execution through `system.run` with safe-bin or allowlist-style auto-approval. It is not an unauthenticated node takeover. ### Affected configurations This affects deployments where: - a POSIX node is paired to the gateway - `system.run` is reachable by an authenticated operator or agent flow - exec policy uses safe-bin or allowlist-based auto-approval - the approved command contains shell-expanded values that can change argv shape ### Impact A lower-privilege operator flow could cause an approved safe-bin command to read a node-local file that was not intended by the policy. Depending on the local files available to the node process, this could expose OpenClaw configuration data or other node-local information. The issue is a policy-enforcement gap in argv validation, not a general statement that every safe-bin command is unsafe. ### Patched Versions The first stable patched version is `2026.5.18`. ### Mitigations Upgrade to `[email protected]` or later. Before upgrading, avoid broad safe-bin auto-approval for commands that can read arbitrary paths, and prefer explicit approval for node commands that touch local files.
Quoted source text, attributed separately from HOL analysis.