OpenClaw versions prior to 2026.2.22 contain an allowlist bypass that allows an attacker to inject the characters $\ followed by a newline and an opening parenthesis inside double quotes. The shell’s line‑continuation feature folds the injected sequences into a command substitution that is executed by system.run, thereby enabling the execution of non‑allowlisted commands. This is an OS Command Injection (CWE‑78) that can run arbitrary system commands and compromise the confidentiality, integrity, or availability of the affected host.

All installations of the generic OpenClaw product that run on Node.js and are deployed before the release of 2026.2.22 are affected, irrespective of operating system. The vulnerability applies to every environment that hosts the OpenClaw application as indicated by the CPE string cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*.

The CVSS score of 6 indicates moderate severity, and no EPSS score is available, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the exploit can be achieved when system.run is invoked with untrusted input; the attack vector is therefore likely local or remote, depending on whether that API is exposed to end users. If an attacker gains sufficient access to trigger system.run, arbitrary command execution is possible.