Executive brief
OpenClaw is a workflow execution tool used to run commands on node hosts, with optional security controls. When configured to use allowlist-based approval on macOS, the tool fails to detect command substitution tokens hidden inside double-quoted strings, allowing attackers to bypass authorization checks and execute unauthorized commands on the host system.
Technical details
The vulnerability is an OS command injection (CWE-78) caused by improper parsing of shell metacharacters during allowlist validation. When security=allowlist mode is enabled on macOS, OpenClaw's system.run parser checks only the first executable token (e.g., /bin/echo) against the allowlist but fails to sanitize or reject command substitution syntax $(…) when it appears inside double-quoted text. An attacker can craft a payload like `/bin/sh -lc 'echo "ok $(/usr/bin/id)"'` where the visible executable echo is allowlisted while the substitution executes arbitrary code. This requires: macOS node-host configuration, allowlist security mode enabled, ask mode set to on-miss or off, and a shell wrapper command containing an allowlisted executable. The fix is available in version 2026.2.22 and later.
Affected products
- OpenClaw OpenClaw <= 2026.2.21-2
Timeline
- 2026-03-03: disclosed
- 2026-03-03: advisory
- 2026-02-23: other: Published on GitHub security advisory