Executive brief
OpenClaw is an npm package used to enforce execution allowlists—a security control that restricts which scripts and commands can run in a system. The vulnerability allows attackers to bypass this allowlist protection by using shell init-file options like --rcfile and --init-file, which can cause the shell to load attacker-controlled initialization code while inheriting trust from an approved script. This enables unauthorized code execution on systems relying on OpenClaw's allowlist feature.
Technical details
The vulnerability is an incomplete input validation issue (CWE-184) in OpenClaw's exec allowlist matching logic. Before version 2026.3.31, the allowlist mechanism did not properly reject shell init-file wrapper invocations (--rcfile, --init-file, --startup-file options), allowing them to inherit trust from matched script paths even though a different initialization file would be loaded first. An attacker can exploit this by controlling the shell command shape when the allowlist or allow-always behavior is enabled, resulting in a narrower allowlist bypass rather than generic arbitrary command execution. The attack requires local access and ability to steer shell wrapper commands. The vulnerability was patched in version 2026.3.31 (March 31, 2026) and later; the fix explicitly rejects shell init-file script matches.
Affected products
- OpenClaw openclaw < 2026.3.31
Timeline
- 2026-04-07: disclosed: Advisory published
- 2026-03-31: patched: Fix released in version 2026.3.31