OpenClaw versions prior to 2026.2.21 contain an approval‑integrity mismatch in the system.run function that allows authenticated operators to inject arbitrary trailing arguments into the cmd.exe /c command. The approval text logs only a benign command, while the actual command executed includes malicious arguments, enabling local command execution on trusted Windows nodes. The vulnerability is a classic command injection flaw (CWE‑88) and can be used to compromise the integrity and availability of the affected system.

Vendor: OpenClaw; Product: OpenClaw; Affected releases: all versions before 2026.2.21.

The CVSS score is 7.1 (High). An EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated operator with access to system.run, thus it is a local attack vector. An attacker can execute arbitrary commands with the privileges of the operator, potentially compromising system integrity or availability. The risk is moderate to high for trusted environments that grant operators this access.