Executive brief
OpenClaw is a command approval and orchestration system that operators use to authorize system commands before execution. In affected versions, the approval interface displays a simplified command preview (e.g., "jq --version") while the actual executed command is different (e.g., a wrapper binary executing the same payload). An attacker with local filesystem access can exploit this mismatch to execute arbitrary code by placing malicious wrapper binaries that operators unknowingly approve.
Technical details
This is an approval-integrity vulnerability (CWE-436, CWE-863) in OpenClaw's node-host system.run approval mechanism. The root cause is a mismatch between approval display logic and execution logic: the approval UI normalizes wrapper binaries by basename and extracts/displays only the inner shell payload text, while the actual execution still uses the full wrapper argv. An attacker with local access can place malicious wrapper binaries and craft wrapper-shaped commands that display innocuous approval text but execute unintended code. Exploitation requires the ability to place binaries on the target system and sufficient operator trust in the approval workflow. The vulnerability was fixed in OpenClaw 2026.3.11 by binding approvals to the exact executed argv while preserving extracted shell payloads only as secondary preview data.
Affected products
- OpenClaw OpenClaw before 2026.3.11
Timeline
- 2026-03-12: disclosed: Original advisory GHSA-rw39-5899-8mxp published