Summary
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
openclaw versions <= 2026.3.12 accepted unsanitized iMessage remote attachment paths when staging files over SCP, allowing shell metacharacters in the remote path operand.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.3.12 - Fixed version:
2026.3.13
Details
The vulnerable path was the remote attachment staging flow in src/auto-reply/reply/stage-sandbox-media.ts. When ctx.MediaRemoteHost was set, OpenClaw staged the attachment by spawning /usr/bin/scp against <remoteHost>:<remotePath>. In affected releases, the remote host was normalized but the remote attachment path was not validated for shell metacharacters before being passed to the SCP remote operand. A sender-controlled iMessage attachment filename containing shell metacharacters could therefore trigger command execution on the configured remote host when remote attachment staging was enabled.
This issue is in scope under OpenClaw's trust model because it crosses an inbound content boundary into host command execution on a configured remote attachment host.
Fix Commit(s)
a54bf71b4c0cbe554a84340b773df37ee8e959de
Thanks @lintsinghua for reporting.
Impact
Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
[email protected] validates the SCP remote path before spawning scp. Current code calls normalizeScpRemotePath(...) and rejects paths containing shell metacharacters instead of passing them through to the remote shell.
Regression coverage exists in src/auto-reply/reply.stage-sandbox-media.scp-remote-path.test.ts (rejects remote attachment filenames with shell metacharacters before spawning scp).
Frequently Asked Questions
- What is GHSA-G2F6-PWVX-R275? GHSA-G2F6-PWVX-R275 is a high-severity OS command injection vulnerability in openclaw (npm), affecting versions <= 2026.3.12. It is fixed in 2026.3.13. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
- Which versions of openclaw are affected by GHSA-G2F6-PWVX-R275? openclaw (npm) versions <= 2026.3.12 is affected.
- Is there a fix for GHSA-G2F6-PWVX-R275? Yes. GHSA-G2F6-PWVX-R275 is fixed in 2026.3.13. Upgrade to this version or later.
- Is GHSA-G2F6-PWVX-R275 exploitable, and should I be worried? Whether GHSA-G2F6-PWVX-R275 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-G2F6-PWVX-R275 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-G2F6-PWVX-R275? Upgrade
openclawto 2026.3.13 or later.