Description
OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution syntax within double-quoted text to bypass security restrictions and execute arbitrary commands on the system.
Problem types
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Product status
Any version before 2026.2.22
2026.2.22 (semver)
Credits
tdjackey
References
github.com/...enclaw/security/advisories/GHSA-9p38-94jf-hgjj (GitHub Security Advisory (GHSA-9p38-94jf-hgjj))
github.com/...ommit/90a378ca3a9ecbf1634cd247f17a35f4612c6ca6 (Patch Commit)
www.vulncheck.com/...-via-command-substitution-in-system-run (VulnCheck Advisory: OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run)