CVE-2026-32052
1 advisory.
npm/openclaw CVE-2026-32052: medium, EPSS 1.68%
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Action: Upgrade openclaw to 2026.2.24 or later.
npm i openclaw@2026.2.24Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2026.2.24 | - |
Fixed versions
| 2026.2.24 |
Sources
- osv: GHSA-6rcp-vxwf-3mfp
- https://github.com/openclaw/openclaw/security/advisories/GHSA-6rcp-vxwf-3mfp
- https://nvd.nist.gov/vuln/detail/CVE-2026-32052
- https://github.com/openclaw/openclaw/commit/0f0a680d3df81739ea5088a2f88e65f938b7936b
- https://github.com/openclaw/openclaw/commit/55cf92578d266987e390c4bf688196af98eac748
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-hidden-command-execution-via-shell-wrapper-positional-argv-carriers
CVE-2026-32052 · published · modified · JSON