Executive brief
OpenClaw is a workflow automation platform that executes system commands. Versions up to 2026.2.23 contain a flaw where hidden commands can be injected and executed through positional arguments, while misleading approval text is displayed to the operator. An authenticated attacker can execute arbitrary commands without proper authorization review.
Technical details
The vulnerability is a command injection issue (CWE-436, CWE-863) in OpenClaw's system.run shell-wrapper functionality. The root cause is a mismatch between the command text displayed for approval and the actual argv vector executed at runtime. When shell-wrapper forms (e.g., /bin/sh -c) are used, positional argv carriers can be appended after the inline shell payload and execute without appearing in the operator-visible approval text. The attack requires authentication and user interaction to approve the misleading command display. An attacker can execute hidden arbitrary commands by crafting payloads with trailing positional arguments that bypass display context validation. The vulnerability is fixed in version 2026.2.24 and later.
Affected products
- OpenClaw OpenClaw <=2026.2.23
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: Version 2026.2.24 published to npm
- 2026-03-21: advisory: GHSA-w6f4-3v35-qjhj published
- 2026-03-24: other: GHSA-w6f4-3v35-qjhj withdrawn as duplicate of GHSA-6rcp-vxwf-3mfp