Executive brief
OpenClaw is a platform that automates system tasks and executes commands on behalf of users. The system.run function includes an allowlist approval mechanism to prevent unauthorized command execution. However, a flaw in the approval parsing logic failed to recognize PowerShell's encoded-command options (-EncodedCommand, -enc, -e), allowing attackers with access to system.run to bypass the approval step and execute arbitrary PowerShell payloads. An authorized user could invoke PowerShell with these flags to circumvent security controls that would normally require explicit approval.
Technical details
OpenClaw's system.run shell-wrapper detection mechanism did not properly identify PowerShell's encoded-command options (-EncodedCommand, -enc, or -e) as inline-command wrappers. When system.run processed command arguments in allowlist mode, requests using these PowerShell flags would fall through to plain argv (argument vector) analysis instead of triggering the normal shell-wrapper approval path. This allowed an attacker with existing access to system.run to invoke pwsh or powershell with encoded commands without requiring the additional approval step that equivalent -Command invocations would trigger. The vulnerability requires the attacker to already have access to the system.run function, but allows them to bypass a secondary authorization check. The fix, committed on March 7, 2026 and released in version 2026.3.7, adds recognition of PowerShell encoded-command aliases during shell-wrapper parsing, restoring the approval requirement for those payloads.
Affected products
- OpenClaw openclaw <=2026.3.2
Timeline
- 2026-03-09: disclosed: GHSA advisory published
- 2026-03-07: patched: Fix committed to main branch
- 2026-03-08: patched: npm version 2026.3.7 released with patch