Executive brief
OpenClaw is an autonomous AI agent platform that executes arbitrary commands on systems. In non-default configurations where the `sort` utility is added to the allowlist of safe binaries, an attacker can use the `--compress-program` flag to execute arbitrary external programs without requiring operator approval. This could allow an attacker to execute malicious code under the OpenClaw process context, potentially compromising system security.
Technical details
The vulnerability is an incomplete input validation (CWE-184) and improper command neutralization (CWE-78) issue in the safe-bin policy for the GNU sort utility. When `sort` is manually added to `tools.exec.safeBins`, the safe-bin profile fails to block the `--compress-program` flag, which allows GNU sort to invoke external programs. In deployments configured with `security=allowlist` and `ask=on-miss=true`, satisfying safe-bin allowlist checks bypasses operator approval prompts. An attacker with access to the OpenClaw interface can invoke `sort --compress-program=<malicious_program>` to execute arbitrary code under the OpenClaw process context without requiring manual approval. The vulnerability only affects non-default installations where sort is explicitly added to the safe-bins configuration. A fix was released in version 2026.2.22 that blocks the `--compress-program` flag in the sort safe-bin policy.
Affected products
- openclaw openclaw <= 2026.2.21-2
Timeline
- 2026-03-03: disclosed: GHSA-4gc7-qcvf-38wg published
- 2026-02-23: patched: Patched version 2026.2.22 planned