OpenClaw versions before 2026.5.18 allow an attacker to modify shell wrapper command arguments after they have been approved by an allowlist, enabling the execution of arbitrary command shapes that were not originally authorized. The flaw, identified as CWE-367, can lead to the injection of malicious commands, compromising the confidentiality, integrity, or availability of the system. The vulnerability is limited to components that rely on the shell wrapper, but the impact can extend across the entire application if the wrapper is part of critical operational paths.

The affected product is OpenClaw by OpenClaw, specifically any deployment running a version earlier than 2026.5.18.

The CVSS score of 8.7 classifies this flaw as high severity. While an EPSS score is not available and it has not been listed in the CISA KEV catalog, the potential for remote code execution and the lack of mitigation mechanisms suggest a significant risk. Attackers would likely target any interface that forwards user inputs to the shell wrapper, exploiting the discrepancy between approval and execution to run unapproved commands.