CVE-2026-28363
CriticalSummary
W OpenClaw przed wersją 2026.2.23 walidacja tools.exec.safeBins dla sortowania mogła być obejściem za pomocą skrótów opcji długich GNU (takich jak --compress-prog) w trybie listy dozwolonej, co prowadziło do ścieżek wykonawczych, które miały wymagać zatwierdzenia. Tylko dokładny ciąg, taki jak --compress-program, był odrzucany.
Risk Assessment
Organizacja może być narażona na nieautoryzowane wykonanie kodu, co może prowadzić do poważnych naruszeń bezpieczeństwa. Potencjalne wykorzystanie tej luki może skutkować nieautoryzowanym dostępem do systemów i danych.
Recommendation
Zaleca się aktualizację OpenClaw do wersji 2026.2.23 lub nowszej, aby zlikwidować tę lukę. Dodatkowo, warto przeprowadzić audyt konfiguracji i monitorować użycie narzędzi w celu wykrycia potencjalnych prób wykorzystania tej podatności.
Related vulnerabilities
- CVE-2026-81797Critical
The WordPress theme Buzz Stone | Magazine & Viral Blog in versions up to 1.0.2 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78535Critical
The WordPress theme Photolia in versions up to 1.0.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78533Critical
The WordPress theme Qwery in versions up to 3.6.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78531Critical
The WordPress theme Jacqueline in versions up to 2.22 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78529Critical
The WordPress theme Alliance in versions up to 3.11 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66569Critical
The WordPress theme Kicker in versions up to 2.2.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66568Critical
The WordPress theme Original in versions up to 1.9.0 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66567Critical
The WordPress theme Anesta in versions up to 1.5.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66565Critical
The WordPress theme FC United in versions up to 1.1.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66564Critical
The WordPress theme ShiftCV in versions up to 3.0.14 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
Original NVD description (English source)
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS