Executive brief
OpenClaw is a security-focused command execution library that uses an allowlist to control which shell commands can run. The vulnerability allows an authenticated attacker to bypass this security control by injecting unquoted shell comments (using #) into commands, causing the allowlist to trust malicious follow-up commands that the shell will never actually execute. This undermines the security guardrail that prevents unauthorized command execution.
Technical details
OpenClaw's allowlist analysis engine (system.run with security=allowlist mode) did not respect POSIX shell comment semantics when deriving allow-always persistence entries. An attacker could submit a shell command with a legitimate pre-comment portion followed by an unquoted # character and arbitrary malicious commands. The shell runtime would execute only the pre-comment portion, but the allowlist persistence mechanism would analyze and store the entire command—including the non-executed malicious tail—as a trusted follow-up. This is an interpretation conflict (CWE-436) leading to incorrect authorization (CWE-863). The fix, deployed in version 2026.3.7, teaches shell tokenization and chain/pipeline analysis to stop at unquoted shell comments, ensuring the allowlist tracks only commands the shell will actually execute. Exploitation requires the caller to already be in allowlist mode and have received an allow-always decision, limiting the attack surface.
Affected products
- OpenClaw OpenClaw <= 2026.3.2
Timeline
- 2026-03-09: disclosed: Advisory published
- 2026-03-08: patched: Fixed in version 2026.3.7 released on npm