Executive brief
OpenClaw is a security-critical runtime system that manages code execution approvals. A vulnerability in how it validates script runner commands allows attackers to obtain approval for a legitimate script, then swap the underlying script file with malicious code before execution—bypassing the approval controls entirely. This could allow unauthorized code execution on systems relying on OpenClaw's approval integrity.
Technical details
The vulnerability is an approval integrity bypass (CWE-863, incorrect authorization) in OpenClaw's system.run approval planner. The approval system tracks mutable script operands only for a hardcoded set of interpreters, causing script runners like tsx and jiti to bypass file binding checks. An attacker with pre-existing approval for a benign script command can rewrite the referenced script file on disk after approval but before execution, causing the modified code to run under the approved context without re-validation. The vulnerability requires network access, low privileges, and user interaction (approval action). It was fixed in OpenClaw 2026.3.11.
Affected products
- OpenClaw openclaw < 2026.3.11
Timeline
- 2026-03-12: disclosed
- 2026-03-11: patched: Fix released in openclaw@2026.3.11