Executive brief
OpenClaw is a command execution framework that runs host commands. A flaw in how it resolves commands from the system PATH allows attackers to hijack execution by placing malicious binaries earlier in PATH, bypassing allowlist protections. This affects authenticated users with access to execution surfaces and victims running OpenClaw from attacker-controlled directories.
Technical details
This vulnerability (CWE-427, CWE-78, CWE-807) stems from unsafe PATH handling in two scenarios: (1) Node host PATH override—authenticated attackers with access to system.run can pass request-scoped PATH environment overrides to execute attacker-controlled binaries matching allowlisted commands; (2) Project-local PATH bootstrapping—when OpenClaw runs from an attacker-controlled directory containing node_modules/.bin/openclaw, attackers can place malicious executables that OpenClaw resolves via PATH. The issue requires either authenticated access to an execution surface or victim interaction (running OpenClaw in a malicious repo). The fix (v2026.2.14+) disables project-local bootstrapping by default and makes Node Host ignore request-scoped PATH overrides.
Affected products
- OpenClaw OpenClaw < 2026.2.14
Timeline
- 2026-02-18: disclosed
- 2026-02-14: patched: Fix planned for v2026.2.14