OpenClaw versions prior to 2026.3.8 allow an attacker to obtain approval for a script to run via the system.run function and then modify the script file before it is executed. The internal handle does not preserve the original script content between the approval and execution phases, enabling the attacker to replace the approved content with malicious instructions without changing the command structure, thereby bypassing the approval mechanism. This vulnerability compromises the integrity of script execution and can lead to arbitrary code running in the application context.

The vulnerable behavior is present in all releases of OpenClaw before 2026.3.8. Users running that software should verify which minor version they are operating and plan an upgrade accordingly.

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower but still notable likelihood of exploitation. An adversary would need to trigger the approval workflow and maintain control over the script file before execution; once accomplished, the attacker can run arbitrary commands. The risk is amplified if system.run is exposed to untrusted users or remote input.