OpenClaw versions older than 2026.2.2 have an exec approvals allowlist bypass that enables attackers to run arbitrary commands by injecting $() or backticks inside double‑quoted strings. The exploit allows the attacker to execute system commands that would normally be prohibited by the allowlist, leading to complete compromise of the affected system when exec approvals are enabled. The weakness is an OS command injection (CWE‑78) that can affect confidentiality, integrity, and availability.

OpenClaw software, including all distributions of the open‑source project that ship with exec approvals enabled, is vulnerable if the installed version predates 2026.2.2. The affected product is the OpenClaw application built on Node.js, and the specific vulnerable releases are all those released before the 2026.2.2 update.

The CVSS score of 9.2 and an EPSS estimate below 1% indicate a high severity vulnerability with a low but non‑zero probability of exploitation. The risk is elevated in environments where the exec approvals feature is enabled, because an attacker can inject command substitution syntax to bypass the allowlist. The vulnerability can be exploited remotely if an attacker can supply input that is processed within double‑quoted strings, or locally through compromised credentials where the exec approvals functionality is active. Based on the description, it is inferred that the attacker must supply input that is evaluated inside double‑quoted strings, which could be achieved via an HTTP request or a local command line interface, so the attack vector is likely remote if user input is exposed. The vulnerability is not currently listed in the CISA KEV catalog.