Duplicate Advisory: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Moderate severity
GitHub Reviewed
Published
Mar 21, 2026
to the GitHub Advisory Database
•
Updated Mar 24, 2026
Withdrawn
This advisory was withdrawn on Mar 24, 2026
Give feedback on Dependabot alerts