Executive brief
OpenClaw is a JavaScript library that provides safe execution of system binaries through an allowlist mechanism. This vulnerability allows attackers who can control the process environment before the application starts to bypass the allowlist by injecting trojan versions of permitted binaries (like jq) into the PATH, enabling arbitrary code execution under a trusted binary name.
Technical details
The vulnerability is a privilege escalation caused by insufficient validation in the tools.exec.safeBins allowlist checks (CWE-426: Untrusted Search Path, CWE-863: Incorrect Authorization). The vulnerable code accepts a resolved executable path based on executable name and argument shape without enforcing that the binary comes from trusted directories. An attacker who can influence the process PATH before gateway startup or control the launch environment can place a malicious trojan binary with an allowlisted name in an earlier PATH entry, bypassing the allowlist validation. The fix requires that resolved executable paths come only from trusted bin directories (system defaults plus the gateway startup PATH). Request-scoped PATH injection is already blocked, so exploitation requires pre-startup environment manipulation.
Affected products
- OpenClaw openclaw >= 2026.1.21, < 2026.2.19
Timeline
- 2026-03-03: disclosed: Published on GitHub and OSV
- 2026-02-21: patched: Fix available in version 2026.2.19
- 2026-03-19: other: Published on NVD as CVE-2026-32015