Unicode Canonicalization Drift Vulnerability in OpenClaw: Policy Bypass Risk
Summary
GHSA-392f-ggf5-fp3c: A paired node could supply Unicode-confusable platform or deviceFamily metadata that passed metadata pinning but classified differently for command policy resolution, broadening default node command allowlists. Affects openclaw versions < 2026.3.1. Fixed in 2026.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing and executing commands in a node environment. It provides a framework for defining and enforcing command policies based on node metadata, such as platform and device family. However, the package has a vulnerability that allows for Unicode-confusable metadata to bypass these policies, potentially broadening the command allowlists beyond intended defaults.
Vulnerability Detail
The vulnerability arises from the way OpenClaw handles node metadata, specifically the 'platform' and 'deviceFamily' attributes. A paired node can supply Unicode-confusable values that pass metadata pinning but are classified differently during command policy resolution. This discrepancy can lead to unauthorized command execution, effectively bypassing the security measures intended to restrict command availability. The issue is classified under CWE-176 (Incorrect Default Permissions) and CWE-436 (Use of Incorrectly Specified Control Element).
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.1
This is the first release that contains the fix.
npm install openclaw@2026.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually review and restrict the command allowlists in your configuration to ensure that only explicitly allowed commands are permitted. This may involve modifying your policy definitions to exclude potentially harmful commands like 'system.run' and 'system.which' unless they are explicitly allowlisted.
Conclusion
The Unicode canonicalization drift vulnerability in OpenClaw poses a significant risk by allowing policy bypass through confusable metadata. It is crucial to update to the patched version 2026.3.1 to mitigate this risk. Additionally, implementing strict command policies can help protect against potential exploitation.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows for policy bypass through Unicode-confusable metadata, which can expand command availability beyond intended defaults.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow unauthorized commands to be executed, leading to security breaches and unauthorized access to system resources.
If an immediate update is not possible, implement strict command allowlists and review your policy definitions to mitigate risks.
The CVSS score for this vulnerability is 6.9, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.