Issues

• [Security] Non-owner embedded agent runs expose owner-only gateway and cron tools in openclaw-cn

  mf-yang/openclaw-cn#610 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Non-owner command-authorized senders can access owner-only gateway and cron tools in openclaw-cn

  mf-yang/openclaw-cn#609 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] POSIX exec-approvals allowlist overmatch lets unintended binaries execute via node-host system.run

  mf-yang/openclaw-cn#608 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] node-host system.run allowlist can be bypassed with env -S to reach arbitrary shell execution

  mf-yang/openclaw-cn#607 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] OpenClaw CN gateway exec safeBins validation leaks workdir file existence through state-dependent allowlist decisions

  mf-yang/openclaw-cn#606 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Sandboxed image tool builder regression allows host-local image disclosure to the configured vision provider

  mf-yang/openclaw-cn#605 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] OpenClaw CN node-host system.run safeBins long-option bypass executes an external helper via sort --compress-prog without approval

  mf-yang/openclaw-cn#604 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Sandboxed write tool can overwrite files outside the workspace through a dangling symlink leaf

  mf-yang/openclaw-cn#603 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Browser /act click interactions bypass the configured SSRF navigation policy and reach loopback targets

  mf-yang/openclaw-cn#602 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Sandboxed message tool can read host files outside sandboxRoot via media=file://... during attachment hydration

  mf-yang/openclaw-cn#601 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] system.run allowlist approval bypass via nested /usr/bin/env dispatch wrappers in openclaw-cn

  mf-yang/openclaw-cn#600 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Non-owner agent tool dispatch exposes admin-only cron and gateway actions in openclaw-cn

  mf-yang/openclaw-cn#599 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Authenticated node-host system.run approval bypass via nested /usr/bin/env argv wrappers

  mf-yang/openclaw-cn#598 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] node-host system.run allowlist can be bypassed with GNU sort --compress-prog to execute an unallowlisted helper

  mf-yang/openclaw-cn#597 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] system.run allowlist mode can be bypassed with an untrusted absolute path whose basename matches a safeBins entry

  mf-yang/openclaw-cn#596 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] node-host system.run allowlist can be bypassed with sort --compress-program to execute an unallowlisted helper

  mf-yang/openclaw-cn#595 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] sort --compress-program safe-bin allowlist bypass leads to arbitrary helper execution on node-host

  mf-yang/openclaw-cn#594 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Node-host system.run allowlist bypass via shell line continuation in double-quoted rawCommand

  mf-yang/openclaw-cn#593 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Authenticated node-host safe-bin allowlist bypass via PATH shadowing

  mf-yang/openclaw-cn#592 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Node host system.run allowlist can be bypassed via double-quoted backslash-newline line continuation

  mf-yang/openclaw-cn#591 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Authenticated operator.write clients can bypass node exec approvals and execute arbitrary commands via node.invoke

  mf-yang/openclaw-cn#590 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] node-host system.run allowlist can be bypassed with env -S to execute inner shell payloads

  mf-yang/openclaw-cn#589 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Windows shell fallback in the Lobster plugin can lead to host command execution

  mf-yang/openclaw-cn#588 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Windows command injection in the optional Lobster plugin shell fallback

  mf-yang/openclaw-cn#587 · Filter by author YLChen-007 opened on Aug 6, 2026

• [Security] Gateway exec allowlist timeout fallback can be bypassed with env -S to reach arbitrary shell execution

  mf-yang/openclaw-cn#586 · Filter by author YLChen-007 opened on Aug 6, 2026