Executive brief
OpenClaw is a framework that provides "safe" wrappers around system binaries like grep to restrict their capabilities. A bug in the grep wrapper allowed attackers to read arbitrary files from the working directory by using the -e flag to bypass the stdin-only restriction. An attacker with the ability to invoke the exec tooling could read sensitive files like .env or credentials.txt that should have been protected.
Technical details
The vulnerability exists in src/infra/exec-safe-bin-policy.ts where grep was configured with maxPositional: 1 and allowed -e/--regexp value flags. Because -e consumes the pattern in flag-value position, the remaining positional argument budget could be used for a file operand, allowing commands like `grep -e SECRET .env`. This violates the intended stdin-only guarantee for safe bins. The attack requires: (1) grep must be opt-in enabled in safeBins configuration (not default), and (2) an actor must have capability to invoke exec tooling under that profile. The fix is available in version 2026.2.21 and later. CWE-184 (Incomplete List of Disallowed Inputs) applies.
Affected products
- OpenClaw openclaw <= 2026.2.19-2
Timeline
- 2026-03-03: disclosed
- 2026-02-21: patched: Fix commit c6ee14d60e4cbd6a82f9b2d74ebeb1e8ee814964
- 2026-03-19: other: NVD published CVE-2026-32022