Executive brief
OpenClaw is a workflow automation tool that approves and executes system commands. A vulnerability in the system.run approval mechanism allowed attackers to obtain approval for a command (like "sh ./script.sh"), then modify the approved script file on disk before execution, causing different code to run under the originally approved command name. This bypasses the approval controls intended to prevent unauthorized command execution.
Technical details
OpenClaw's system.run approval flow failed to bind mutable script operands (file paths to scripts) at approval time, creating a time-of-check time-of-use (TOCTOU) race condition (CWE-367, CWE-285). When a caller requested approval for a command like "sh ./script.sh", the approval was granted based on the command shape and argv values, but the actual script file content was not snapshotted or locked. An attacker could rewrite the script file between approval and execution, causing different code to execute while maintaining the same approved command signature. The initial patch in v2026.3.8 addressed shell scripts but missed bun and deno interpreters; a follow-up fix on the same day extended binding to all interpreter types. Network-accessible systems with approval workflows enabled and low-privilege users allowed to request approvals are affected.
Affected products
- OpenClaw OpenClaw <= 2026.3.7
Timeline
- 2026-03-10: disclosed
- 2026-03-09: patched: Complete fix in commit cf3a479bd1204f62eef7dd82b4aa328749ae6c91 for bun/deno script operands; v2026.3.8
- 2026-03-31: other: GHSA-wwrj-437c-ppq4 published (later withdrawn as duplicate)
- 2026-04-06: other: GHSA-wwrj-437c-ppq4 withdrawn as duplicate of GHSA-8g75-q649-6pv6