OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the system.run execution routine. The flaw causes the runtime to fail to unwrap environment and shell‑dispatch wrapper chains, so an attacker can use wrapper binaries such as "env bash" to disguise non‑allowlisted commands. This allows malicious payloads to be executed while appearing to meet allowlist requirements, granting the attacker the ability to execute arbitrary commands on the host system. The weakness is identified as CWE‑78 – OS Command Injection.

The affected product is OpenClaw:OpenClaw. All installations of OpenClaw with a version earlier than 2026.2.22 are vulnerable. The CVE data does not specify additional sub‑versions or platform constraints, but the Common Platform Enumeration (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*) indicates a Node.js runtime environment for the affected product.

The CVSS score is 7.1, indicating a high risk of exploitation. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation yet. The likely attack vector is local or indirect, requiring an attacker to influence a call to system.run. If system.run is exposed to untrusted input, the vulnerability can be abused to execute arbitrary commands without requiring additional privileges, presenting a serious threat to confidentiality, integrity, and availability of the affected system.