Executive brief
OpenClaw is a Node.js-based workflow automation tool that includes an approval system for executing system commands. A semantic drift vulnerability in the command approval wrapper allows an attacker to execute a different local script than the one an operator approved, by placing a malicious file in the working directory and exploiting argv rewriting logic that changes how the shell interprets the command.
Technical details
The vulnerability is an argument injection flaw (CWE-88) in openclaw's node-host approval hardening for system.run execution. The root cause lies in src/node-host/invoke-system-run-plan.ts, which rewrites argv[0] to the resolved executable path. When processing a wrapper command like ['env','sh','-c','echo SAFE'], the resolver unwraps dispatch wrappers and resolves 'sh' to '/bin/sh', producing ['/bin/sh','sh','-c','echo SAFE']. While the approval UI displays 'echo SAFE', the rewritten argv causes /bin/sh to interpret the positional 'sh' argument as a script path, leading to execution of a local ./sh file instead of the approved payload. Exploitation requires that an attacker can both influence wrapper argv and place a malicious file in the approved working directory, and that an operator grants approval for the displayed command. The issue was fixed in version 2026.3.2 (commit dded569626b0d8e7bdab10b5e7528b6caf73a0f1).
Affected products
- OpenClaw openclaw 2026.3.1
Timeline
- 2026-03-03: disclosed
- 2026-03-02: patched: Fixed in version 2026.3.2