| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
The jq safe-bin policy blocked explicit env usage but still allowed jq programs that accessed environment data through $ENV.
An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.
src/infra/exec-safe-bin-semantics.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 78e2f3d66d (Exec: tighten jq safe-bin env checks).
Thanks @nicky-cc of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free