Executive brief
OpenClaw is a command-planning and approval system used to control script execution in Node.js environments. A flaw in how it validates `pnpm dlx` commands allowed an operator to approve a benign local script, which could then be replaced with malicious code before execution while the approval remained valid. This permits execution of unapproved commands under the guise of legitimate approvals.
Technical details
The vulnerability is an incorrect authorization check (CWE-863) in OpenClaw's node-host command-planning module. Before version 2026.4.2, `pnpm dlx` approval planning did not bind local script operands the same way as related `pnpm exec` flows, leaving the approved command unbound at execution time. An attacker (specifically an operator with approval authority) could approve a benign local script, then replace it with malicious code before execution without invalidating the approval. The fix binds local scripts in `pnpm dlx` approval plans, ensuring the effective runtime command is resolved at approval time rather than remaining unbound. No authentication bypass or network-based exploitation is required—the attack requires operator-level access to the approval system.
Affected products
- OpenClaw OpenClaw <= 2026.4.1
Timeline
- 2026-04-07: disclosed: Advisory published
- 2026-04-02: patched: Fix committed; patched in version 2026.4.2