OpenClaw versions prior to 2026.2.24 allow an attacker to bypass the approval gating in system.run allowlist mode. By chaining nested dispatch wrappers such as /usr/bin/env, the system can suppress shell-wrapper detection and execute /bin/sh -c commands without triggering the expected approval prompt. This represents a vulnerability in the command execution path, classified as CWE-863, that can lead to unauthorized code execution on the host system.

All OpenClaw installations with a version earlier than 2026.2.24 are affected, irrespective of operating system or Node.js environment. The vulnerability is present in the OpenClaw product as indicated by the CPE string cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*.

The vulnerability has a CVSS score of 6, indicating a moderate severity. EPSS information is not provided, and the vulnerability is not listed in KEV, suggesting no known widespread exploitation. The attack vector is likely local or requires the ability to influence system.run calls; based on the description, exploitation likely requires local execution or privileged use of system.run, but the exact vector is not detailed in the provided data.