OpenClaw versions earlier than 2026.2.25 perform a time‑of‑check, time‑of‑use validation for the cwd parameter of its system.run command. The parameter is checked during approval but resolved again when execution occurs, creating a gap that an attacker can exploit by replacing the symbolic link used as the cwd between approval and execution. Through this mechanism the attacker can execute arbitrary commands on the node that hosts OpenClaw.

The vulnerability affects all installations of OpenClaw running a version before 2026.2.25. The affected product is the Node.js‑based OpenClaw platform, specifically its system.run functionality which is used to run commands on the node hosts.

The CVSS score is 5.9, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to modify a symbolic link used as the cwd between approval and execution, implying an attack vector that requires local file‑system write access to the OpenClaw environment. No public exploit has been reported, but the clear path to arbitrary command execution presents a moderate risk to affected systems.