中国信通院联合高校发现并修复 OpenClaw 高危命令注入漏洞

Gate News 消息,3 月 16 日,中国信通院与上海交通大学、南京大学联合团队在对开源自主智能体框架 OpenClaw 进行安全审计时,发现其 bash-tools 模块存在 LLM 驱动型命令注入高危漏洞。该漏洞源于系统未对 LLM 生成的命令行参数进行严格转义,攻击者可通过诱导性 Prompt 绕过正则防御,在宿主机上实现远程代码执行并窃取敏感数据。研究团队已完成在多种主流模型环境下的攻击验证,启动负责任漏洞披露流程,并向 NVDB 人工智能产品安全漏洞专业库(CAIVD)和 GitHub 社区提交修复建议。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Commento
0/400
Nessun commento