GHSA-6f6j-wx9w-ff4j
CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
On Windows ACPX paths, wrapper resolution for `.cmd`/`.bat` could fall back to shell execution in ways that allowed `cwd` influence to alter execution behavior.
### Impact
In affected Windows ACPX configurations, this could enable command execution integrity loss through cwd-influenced wrapper resolution.
### Fix
Wrapper resolution now prefers explicit PATH/PATHEXT entrypoint resolution and unwrapped Node/EXE execution, with strict fail-closed handling enabled by default for unresolvable wrapper cases.
### Affected and Patched Versions
- Affected: `>= 2026.2.26, < 2026.3.1`
- Patched: `2026.3.1`
References
External links from the advisory. They lead to third-party sites.