Junglewise Threat Intelligence

CVE-2026-31993: OpenClaw macOS companion allowlist parsing bypass in system.run

CVE-2026-31993 · Severity: medium · CVSS 4 · Published 2026-03-02

Vendors: Openclaw.

Executive brief

OpenClaw's macOS companion app allows authorized users to approve and execute shell commands on paired Mac systems through a control interface. A parsing flaw in the command allowlist checker could allow an attacker with authenticated operator access to craft shell-chain payloads that pass validation but execute unintended commands on the target Mac. This requires the target system to have exec approvals configured in allowlist mode with interactive prompts enabled, and affects only the beta macOS companion app—default installations are not at risk.

Technical details

The vulnerability is a command allowlist parsing mismatch (CWE-184, CWE-285) in OpenClaw's macOS companion app exec approval mechanism. The parser fails to properly evaluate shell control and expansion syntax characters (&&, ||, ;, |, backticks, $, <, >, parentheses) within raw shell command text, allowing multi-command chains to bypass the allowlist validator. An authenticated caller with operator.write permissions can submit a shell-chain command that is evaluated incompletely during the allowlist check (first-token only), approves it from an incomplete command view, and then executes the full chained payload on the paired macOS host. This requires all of: authenticated access, operator.write privilege, a paired macOS beta node, and exec approvals configured with security=allowlist and ask=on-miss. The fix hardens the macOS allowlist resolver to evaluate shell chains per-segment and fail closed on unsafe shell-substitution parsing in allowlist mode, released in version 2026.2.22.

Affected products

  • OpenClaw macOS companion app <= 2026.2.21-2

Timeline

  • 2026-03-02: disclosed: Vulnerability publicly disclosed via GitHub advisory GHSA-5f9p-f3w2-fwch
  • 2026-02-21: patched: Patch commits authored; fix planned for release 2026.2.22
  • 2026-03-02: other: Reporter credited as @tdjackey

References