| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.11 | 2026.3.11 |
| openclaw | < 2026.3.11 | 2026.3.11 |
matchesExecAllowlistPattern normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the ? wildcard could match /, which allowed matches to cross path segments.
These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.
openclaw <= 2026.3.8
Fixed in openclaw 2026.3.11 and included in later releases such as 2026.3.12. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free