The flaw lies in the OpenClaw macOS client’s handling of openclaw://agent deep links that omit an unattended key. The confirmation dialog only shows the first 240 characters of the proposed message, but the entire message is executed when the user presses “Run.” By padding the message with whitespace, an attacker can place a malicious payload outside the displayed preview, causing the user to approve a benign snippet while a harmful command is actually carried out. Because the agent can invoke arbitrary tools that the user has enabled, this breach can lead to the execution of commands with the user’s privileges, as reflected in the CVSS score of 7.1.

OpenClaw desktop client for macOS (openclaw:openclaw). Versions 2026.2.6 through 2026.2.13 are vulnerable. The issue was addressed in release 2026.2.14.

The exploit requires a user to click the confirmation dialog triggered by a crafted deep link, making it a social‑engineering attack. The low EPSS score (<1%) indicates that widespread automated exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the impact is significant if a privileged user approves a malicious command. No requirement for elevated OS privileges means local users can be affected; the ability to execute arbitrary commands depends on the tool approvals configured in the OpenClaw agent.