OpenClaw Tools.exec.safeBins Validation Bypass Vulnerability Allowing Approval-Free Execution

A vulnerability in OpenClaw versions through 2026.2.22-2 allows for a bypass of the tools.exec.safeBins validation for the sort command. This issue arises from the handling of GNU long-option abbreviations, such as --compress-prog, which can be used to circumvent approval requirements in allowlist mode. The vulnerability enables execution paths that should normally require approval to be accessed without it.

Impact

Exploiting this vulnerability could lead to unauthorized execution of commands that are supposed to require approval, potentially allowing for malicious actions to be performed without oversight.

Remediation

Users can upgrade to OpenClaw version 2026.2.23 or later to address this vulnerability.