Executive brief
OpenClaw is a tool for executing commands with approval controls. On Windows, the command execution system does not properly validate commands against an allowlist when they contain special shell characters. An attacker can craft commands using Windows shell syntax (like command chaining with &) to execute unauthorized operations that bypass the security allowlist, potentially enabling unauthorized command execution on protected systems.
Technical details
This is an OS command injection vulnerability (CWE-78) in OpenClaw's Windows command execution path. The root cause is that when exec allowlist/approval-gating is enabled on Windows nodes, the allowlist analysis does not account for cmd.exe parsing and metacharacter behavior. Commands are executed via cmd.exe /d /s /c <rawCommand>, but the allowlist validation operates on the raw command string without modeling how cmd.exe will parse it. An attacker can inject shell metacharacters (such as &, %, !) that cmd.exe will interpret as command chaining or variable expansion, causing execution of commands beyond what was allowlisted/approved. This is a local attack vector requiring the attacker to have the ability to submit commands to an OpenClaw instance that has Windows allowlist/approval gating enabled. The vulnerability affects openclaw versions <= 2026.2.1 and is patched in version >= 2026.2.2 by rejecting Windows shell metacharacters, treating cmd.exe invocation as unsafe in allowlist mode, and executing parsed argv directly when possible.
Affected products
- OpenClaw openclaw <= 2026.2.1
Timeline
- 2026-02-17: disclosed: Advisory published
- 2026-02-17: patched: Patch released in version 2026.2.2
- 2026-03-05: other: CVE-2026-28391 published in NVD