Executive brief
OpenClaw is a tool used to control which system commands can be executed in a restricted environment through an approval allowlist. When the "sort" command is added to a non-default configuration setting, an attacker with administrative privileges can bypass the approval controls using the --compress-program option to invoke unauthorized external commands, potentially compromising system security and data integrity.
Technical details
This vulnerability is a configuration bypass (CWE-15) and OS command injection (CWE-78) affecting OpenClaw's safeBins approval mechanism. When "sort" is explicitly configured in tools.exec.safeBins (a non-default setting), the --compress-program option can be abused to invoke external helper programs that are not subject to the intended allowlist constraints. The attack requires local access and administrative privileges (high privilege requirement, high attack complexity), but no user interaction. An attacker can execute arbitrary commands outside the approved safe-bin allowlist, achieving full confidentiality, integrity, and availability compromise. The vulnerability is patched in version 2026.2.22 and later.
Affected products
- OpenClaw OpenClaw <=2026.2.21-2
Timeline
- 2026-02-23: disclosed: Advisory published
- 2026-02-22: patched: Fix committed; patch released in version 2026.2.22