GHSA-392f-ggf5-fp3c OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists
Attackers can bypass node command allowlists via Unicode confusables in metadata, potentially executing unauthorized system commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-392f-ggf5-fp3c?
GHSA-392f-ggf5-fp3c is a vulnerability in openclaw, published on 2 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Summary
A paired node could supply Unicode-confusable platform or deviceFamily metadata that passed metadata pinning but classified differently for command policy resolution, broadening default node command allowlists.
Impact
This is a policy-bypass issue within the paired-node trust boundary and can expand node command availability beyond intended defaults.
Fix
Node metadata canonicalization was hardened against confusables, and unknown platform defaults were made conservative (excluding system.run and system.which unless explicitly allowlisted).
Affected and Patched Versions
- Affected:
<= 2026.2.26 - Patched:
2026.3.1
Which versions are affected by GHSA-392f-ggf5-fp3c?
2 open source packages ship an affected version, including openclaw.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | All versions | 2026.3.1 |
openclaw npm | All versions | 2026.3.1 |
How do I fix GHSA-392f-ggf5-fp3c?
Upgrade openclaw to 2026.3.1 or later.
Is GHSA-392f-ggf5-fp3c being exploited?
There is no known exploitation of GHSA-392f-ggf5-fp3c in the wild and no public exploit code.