[openclaw] OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

**[openclaw] OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags**

Summary tools.exec.safeBins could be bypassed for filesystem access when sort output flags (-o / --output) or recursive grep flags were allowed through safe-bin execution paths. Affected Packages / Versions Package: openclaw (npm) Affected versions: <= 2026.2.17 Patched versions: >= 2026.2.19 Latest published version at triage time: 2026.2.17 Impact In deployments that enabled tools.exec.safeBins, an attacker with access to command execution flows could turn intended stdin-only safe-bin usage into file writes (sort -o) or recursive file reads (grep -R). Fix Commit(s) cfe8457a0f4aae5324daec261d3b0aad1461a4bc Thanks @nedlir for reporting. References https://github.com/openclaw/openclaw/security/advisories/GHSA-4685-c5cp-vp95 https://github.com/openclaw/openclaw/commit/cfe8457a0f4aae5324daec261d3b0aad1461a4bc https://github.com/advisories/GHSA-4685-c5cp-vp95

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.