要点
- CVE-2026-22169 は openclaw (openclaw), openclaw に影響する深刻度「中」 (CVSS 6.7) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.21%（全脆弱性の 10.5% より高い）。
- 対処：2026.2.22 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| openclaw | < 2026.2.22
| 2026.2.22
|
| openclaw npm | < 2026.2.22
| 2026.2.22
|
概要
When sort is explicitly added to tools.exec.safeBins (non-default), the --compress-program option can invoke an external helper and bypass the intended safe-bin approval constraints in allowlist mode.
Affected Packages / Versions
- Package:
openclaw (npm)
- Vulnerable versions:
<=2026.2.21-2
- Latest published npm version checked during triage:
2026.2.21-2 (as of February 22, 2026)
- Patched in planned next release:
2026.2.22
Fix Commit(s)
57fbbaebca4d34d17549accf6092ae26eb7b605c
Release Process Note
patched_versions is pre-set to the planned next release (>=2026.2.22). Once that npm release is published, the advisory can be published directly.
OpenClaw thanks @tdjackey for reporting.
NVD の説明
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin approval constraints by leveraging the compress-program parameter to execute unauthorized external programs.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン