GHSA-ff98-w8hj-qrxf OpenClaw plugin runtime command execution is part of trusted plugin boundary
Clarifies that OpenClaw plugins execute with full process privileges, meaning runtime command helpers do not provide sandbox isolation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-ff98-w8hj-qrxf?
GHSA-ff98-w8hj-qrxf is a vulnerability in openclaw, published on 3 Mar 2026.
Official description
Summary
OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (runtime.system.runCommandWithTimeout).
Impact
Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published version reviewed:
2026.2.17 - Affected range for this advisory record:
<= 2026.2.17 - Planned patched version metadata:
2026.2.19(next release line)
Fix Commit(s)
2e421f32dfc589c02706265fd3c3137ffc06c4b1
Remediation
- Install only trusted plugins.
- Use
plugins.allowto pin explicit trusted plugin IDs. - SECURITY.md now explicitly documents that plugin runtime helpers are convenience APIs, not a sandbox boundary.
OpenClaw thanks @markmusson for reporting.
Which versions are affected by GHSA-ff98-w8hj-qrxf?
2 open source packages ship an affected version, including openclaw.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | All versions | 2026.2.19 |
openclaw npm | All versions | 2026.2.19 |
How do I fix GHSA-ff98-w8hj-qrxf?
Upgrade openclaw to 2026.2.19 or later.
Is GHSA-ff98-w8hj-qrxf being exploited?
There is no known exploitation of GHSA-ff98-w8hj-qrxf in the wild and no public exploit code.