Medium severity6.7NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-29608

Description

OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	>= 2026.3.1, < 2026.3.2	2026.3.2

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:2026.3.1:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:2026.3.1:*:*:*:*:node.js:*:*
- (no CPE)range: 2026.3.1
ghsa-coords
pkg:npm/openclaw
Range: >= 2026.3.1, < 2026.3.2

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/dded569626b0d8e7bdab10b5e7528b6caf73a0f1nvdPatchWEB
github.com/advisories/GHSA-h3rm-6x7g-882fghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-h3rm-6x7g-882fnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-29608ghsaADVISORY
www.vulncheck.com/advisories/openclaw-approval-integrity-bypass-via-system-run-argv-rewritingnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.436
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000