In short
- CVE-2026-22169 is a MEDIUM (CVSS 6.7) vulnerability affecting openclaw (openclaw), openclaw.
- Chance of exploitation in the next 30 days (EPSS): 0.21%, higher than 10.5% of all vulnerabilities.
- Fix: update to 2026.2.22 or later.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.2.22
| 2026.2.22
|
| openclaw npm | < 2026.2.22
| 2026.2.22
|
Description
When sort is explicitly added to tools.exec.safeBins (non-default), the --compress-program option can invoke an external helper and bypass the intended safe-bin approval constraints in allowlist mode.
Affected Packages / Versions
- Package:
openclaw (npm)
- Vulnerable versions:
<=2026.2.21-2
- Latest published npm version checked during triage:
2026.2.21-2 (as of February 22, 2026)
- Patched in planned next release:
2026.2.22
Fix Commit(s)
57fbbaebca4d34d17549accf6092ae26eb7b605c
Release Process Note
patched_versions is pre-set to the planned next release (>=2026.2.22). Once that npm release is published, the advisory can be published directly.
OpenClaw thanks @tdjackey for reporting.
NVD description
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin approval constraints by leveraging the compress-program parameter to execute unauthorized external programs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free