OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
Summary
In affected versions of openclaw, node-host system.run approvals did not bind a mutable file operand for some script runners, including forms such as tsx and jiti. An attacker could obtain approval for a benign script-runner command, rewrite the referenced script on disk, and have the modified code execute under the already approved run context.
Impact
Deployments that rely on node-host system.run approvals for script integrity could execute rewritten local code after operator approval. This can lead to unintended local code execution as the OpenClaw runtime user.
Affected Packages and Versions
- Package:
openclaw(npm) - Affected versions:
< 2026.3.11 - Fixed in:
2026.3.11
Technical Details
The approval planner only tracked mutable script operands for a hardcoded set of interpreters and runtime forms. Commands such as tsx ./run.ts and jiti ./run.ts fell through without a bound file snapshot, so the final pre-execution revalidation step was skipped.
Fix
OpenClaw now fails closed for approval-backed interpreter and runtime commands unless it can bind exactly one concrete local file operand, and it extends direct-file binding coverage for additional runtime forms. The fix shipped in openclaw@2026.3.11.
Workarounds
Upgrade to 2026.3.11 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.3.11 | 2026.3.11 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53
- https://nvd.nist.gov/vuln/detail/CVE-2026-32978
- https://github.com/openclaw/openclaw
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.11
- https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-unrecognized-script-runners
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-863- Platform
- npm
- Package
openclaw- Disclosed
- 13.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-qc36-x95h-7j53 - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.