OpenClaw versions prior to 2026.2.22 on macOS node-host contain an allowlist bypass that enables remote attackers to execute commands not on the allowlist by using command substitution inside double‑quoted strings. The vulnerability stems from improper parsing of command substitution tokens, leading to arbitrary command execution. The weakness corresponds to CWE‑78, which describes code injection through operating system command execution.

The affected vendor is OpenClaw; the product is OpenClaw. All releases earlier than version 2026.2.22 are vulnerable. The CPE identifier is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*. Users should upgrade to version 2026.2.22 or later to resolve the flaw.

The vulnerability has a CVSS score of 7.5, indicating high severity, but the EPSS score is not available and it is not listed in KEV, suggesting limited public exploitation data. The likely attack vector is remote, where an attacker crafts a shell payload containing command substitution syntax within double‑quoted text to bypass the allowlist. Once executed, the attacker can run arbitrary system commands, compromising confidentiality, integrity, and availability of the host.