Executive brief
OpenClaw is a workflow automation framework that executes system commands. The system.run component displays one command to the operator for approval but executes additional hidden arguments at runtime, allowing an attacker with local access to inject arbitrary commands that execute without operator knowledge or consent.
Technical details
A validation weakness in OpenClaw's system.run shell-wrapper (e.g., /bin/sh -c) allows an approval display to show only the inline shell payload while the runtime execution uses the full argv vector, including trailing positional arguments. This creates an interpretation conflict (CWE-436) and authorization bypass (CWE-863): an operator approves a safe-looking command but hidden argv carriers execute silently. The vulnerability affects all versions through 2026.2.23. An authenticated user with access to invoke system.run can craft a malicious payload with concealed arguments. The fix (available in 2026.2.24+) validates that display-bound command text matches the full execution argv and rejects mismatches.
Affected products
- OpenClaw openclaw <= 2026.2.23
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: openclaw 2026.2.24 published with fix
- 2026-03-03: advisory: GHSA-6rcp-vxwf-3mfp published