Junglewise Threat Intelligence

CVE-2026-28470: OpenClaw exec allowlist bypass via command substitution in double quotes

CVE-2026-28470 · Severity: low · CVSS 3.1 · Published 2026-02-17

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is an AI automation platform that can execute shell commands. It offers an optional security feature called "exec approvals" that uses an allowlist to restrict which commands can run. This vulnerability allows attackers to bypass that allowlist by using command substitution syntax (like `$()` or backticks) hidden inside double-quoted strings, potentially executing arbitrary commands if the allowlist feature is enabled.

Technical details

This is an OS command injection vulnerability (CWE-78, CWE-88) in OpenClaw's exec approvals allowlist parsing logic. The root cause is insufficient validation of shell metacharacters during allowlist analysis—specifically, unescaped `$()` and backtick command substitution operators inside double-quoted strings were not being properly rejected. An attacker who can influence command strings passed to the allowlist checker can craft payloads that bypass approval checks by embedding command substitution within double quotes, which are then executed by the shell. The impact is limited to deployments that explicitly enable the optional exec approvals allowlist feature; default installations are unaffected. The fix, released in version 2026.2.2 (commit d1ecb46), hardens the allowlist parser to reject unescaped command substitution syntax even when enclosed in double quotes, with a recommendation to use single quotes for literal `$()` text if needed.

Affected products

  • OpenClaw openclaw <= 2026.2.1

Timeline

  • 2026-02-17: disclosed: Vulnerability published
  • 2026-02-02: patched: Fix committed (prior to public disclosure)
  • 2026-02-17: advisory: GitHub advisory GHSA-3hcm-ggvf-rch5 published

References

Related threats