Executive brief
OpenClaw is a Node.js-based system management tool that uses approval workflows to control system command execution. A vulnerability in versions prior to 2026.3.1 allowed attackers to execute a different binary than what was originally approved by modifying PATH resolution after an administrator had already authorized the command, potentially enabling arbitrary code execution on managed systems.
Technical details
OpenClaw's system.run approval mechanism failed to pin the executable identity for non-path-like argv[0] tokens (e.g., bare command names like "tr"). The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition where PATH resolution could be altered after approval validation but before execution. An attacker with local access could modify the system PATH or place a malicious executable in a PATH directory to cause execution of an unintended binary. The fix requires immutable systemRunPlan data and realpath canonicalization of executable identity across approval and execution phases.
Affected products
- OpenClaw OpenClaw <= 2026.2.26
Timeline
- 2026-03-02: disclosed