The vulnerability arises from the construction of a shell command in the keychain credential refresh path of OpenClaw’s Claude CLI on macOS. In versions 2026.2.13 and older, the JSON blob holding OAuth tokens is passed unchecked to the "security add-generic-password" command. Because the tokens are user‑controlled, an attacker can inject arbitrary shell commands. The flaw is a Command Injection (CWE‑78) and could allow arbitrary code execution with the privileges of the OpenClaw process.

The vulnerable product is OpenClaw, a personal AI assistant built on Node.js. Any installations using version 2026.2.13 or earlier running on macOS are affected.

The CVSS score of 7.6 reflects high severity, yet the EPSS is 0.012%, indicating an extremely low likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker would need to supply a malicious OAuth token to the affected instance, implying a local or privileged context. If such a token is injected, the arbitrary command will run with the OpenClaw process’s rights.