Executive brief
OpenClaw is a plugin-based extensibility platform where third-party plugins run directly in the same process as the core application. The advisory clarifies that plugin access to runtime command execution APIs (such as runCommandWithTimeout) is not crossing an additional security boundary because plugins already run with the same operating system privileges as the main process. Organizations should ensure only trusted plugins are installed and use configuration controls to restrict which plugins can execute on their systems.
Technical details
This advisory addresses CWE-78 (OS Command Injection) in the context of OpenClaw's plugin architecture. The vulnerability is not a traditional code flaw but rather a trust-boundary clarification: the runtime.system.runCommandWithTimeout API exposes OS command execution capabilities to in-process plugins. Since plugins run with the same OS privileges as the OpenClaw process itself, the exposure of command execution helpers does not cross an additional sandbox boundary. The attack requires a malicious or compromised plugin to be installed, which is a trust assumption rather than a code vulnerability. Mitigation involves installing only trusted plugins and using the plugins.allow configuration to explicitly whitelist plugin IDs. The fix (commit 2e421f32dfc589c02706265fd3c3137ffc06c4b1) restores secure defaults and documentation in SECURITY.md now explicitly clarifies that plugin runtime helpers are convenience APIs, not sandbox boundaries.
Affected products
- OpenClaw openclaw <= 2026.2.17
Timeline
- 2026-03-03: disclosed: GHSA-ff98-w8hj-qrxf published
- 2026.2.19: patched: Patched version released