A local OS command injection flaw exists in the JsBridge component of the openclaw-android library. The vulnerability allows an attacker with local access to the device or the ability to run the application to inject and execute arbitrary system commands via the operating system shell. The weakness is categorized as an OS command injection (CWE‑77 and CWE‑78) and, if exploited, could potentially compromise confidentiality, integrity, and availability of the device.

The flaw affects AidanPark openclaw-android implementations up to version 0.4.0 that include the Android WebView Bridge. No other products are listed as impacted; the affected code resides in android/app/src/main/java/com/openclaw/android/JsBridge.kt.

The CVSS score of 4.8 denotes moderate risk, while the EPSS score of less than 1% indicates a very low, but non‑zero, likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attacks can only be performed locally, requiring the attacker to either be physically present, have a local user account, or otherwise run the application. Once the injection succeeds, arbitrary system commands can be executed, potentially leading to full device compromise or lateral movement within the device’s environment.