Executive brief
OpenClaw is a Node.js runtime security tool that approves code execution requests before running them. An attacker with local access to the system can manipulate unapproved script runners (like tsx and jiti) by obtaining approval for a benign command, then rewriting the script file on disk before execution. The modified code runs under the already-approved context, allowing unauthorized code execution with the OpenClaw runtime user's privileges.
Technical details
This is an authorization bypass vulnerability (CWE-863) in the approval verification logic. The root cause is that OpenClaw's approval planner only tracked mutable script operands for a hardcoded set of interpreters; unrecognized script runners like tsx and jiti were not validated for file binding snapshots, causing the final pre-execution revalidation step to be skipped. An attacker with code change capabilities can obtain approval for a benign script-runner command, then modify the referenced script on disk between approval and execution. Attack requires local file system access and user interaction (operator approval), but once approved, the rewritten code executes in the already-approved run context. The fix in 2026.3.11 extends file binding coverage for additional runtime forms and fails closed unless exactly one concrete local file operand can be bound.
Affected products
- OpenClaw openclaw < 2026.3.11
Timeline
- 2026-03-13: disclosed
- 2026-03-11: patched: Fix released in openclaw@2026.3.11