The maintainer/dev script scripts/update-clawtributors.ts in OpenClaw contains a command injection flaw. It constructs a shell command by embedding a GitHub login derived from git log author metadata into a call to execSync. A crafted commit author email can inject shell metacharacters, allowing an attacker to execute arbitrary commands during the update process. This flaw is limited to the script; normal CLI operation via npm is unaffected.

Affected versions are 2026.1.8 through 2026.2.13 of OpenClaw, released under the openclaw:openclaw package. The weakness specifically impacts contributors and maintainers who run the update script locally or in continuous‑integrations that execute the script on source checkouts containing malicious commit metadata. The incident was mitigated in version 2026.2.14, which patches the string interpolation.

With a CVSS score of 8.6, the vulnerability is considered high severity. EPSS is below 1%, indicating a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. The attack vector is likely local or privileged; the flaw requires an attacker to orchestrate a malicious commit in the repository and then run the updater script on an affected environment. If executed, arbitrary commands run with the privileges of the user invoking the script.