CVE-2026-31996

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31996
OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesystem operations through sort output flags or recursive grep flags. Attackers with command execution access can leverage sort -o flag for arbitrary file writes or grep -R flag for recursive file reads, circumventing intended stdin-only restrictions.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/2c05cbb43e48ebad03626d3125746fb1b9a8520f Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-4685-c5cp-vp95 Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-safebins-stdin-only-bypass-via-sort-output-and-recursive-grep-flags Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

25 Mar 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 3.6 		v2 : unknown
v3 : 4.4
Summary
  • (es) Las versiones de OpenClaw anteriores a 2026.2.19 tools.exec.safeBins contiene una vulnerabilidad de omisión de validación de entrada que permite a los atacantes ejecutar operaciones de sistema de archivos no intencionadas a través de indicadores de salida de sort o indicadores de grep recursivos. Los atacantes con acceso de ejecución de comandos pueden aprovechar el indicador sort -o para escrituras de archivos arbitrarias o el indicador grep -R para lecturas de archivos recursivas, eludiendo las restricciones intencionadas de solo stdin.

19 Mar 2026, 18:06

Type Values Removed Values Added
References () https://github.com/openclaw/openclaw/commit/2c05cbb43e48ebad03626d3125746fb1b9a8520f - () https://github.com/openclaw/openclaw/commit/2c05cbb43e48ebad03626d3125746fb1b9a8520f - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-4685-c5cp-vp95 - () https://github.com/openclaw/openclaw/security/advisories/GHSA-4685-c5cp-vp95 - Vendor Advisory
References () https://www.vulncheck.com/advisories/openclaw-safebins-stdin-only-bypass-via-sort-output-and-recursive-grep-flags - () https://www.vulncheck.com/advisories/openclaw-safebins-stdin-only-bypass-via-sort-output-and-recursive-grep-flags - Third Party Advisory
First Time Openclaw openclaw
Openclaw
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

19 Mar 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-19 02:16

Updated : 2026-03-25 15:16

NVD link : CVE-2026-31996

Mitre link : CVE-2026-31996

CVE.ORG link : CVE-2026-31996

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')