OpenClaw versions prior to 2026.5.18 contain a policy enforcement flaw in the system.run safe‑bin allowlist validation. The flaw allows shell metacharacters in authorized commands to be interpreted by the shell, enabling the command to reference unintended node‑local files. An authenticated operator can therefore read configuration or other sensitive data that should not be accessible through the approved command set. This vulnerability provides a confidentiality breach by exposing files on the local filesystem without granting further privileges.

The legacy OpenClaw application on node.js platforms is vulnerable. Any installation of OpenClaw older than 2026.5.18 running on POSIX systems is affected; versions 2026.5.18 and newer are not susceptible.

The CVSS score of 7.6 marks this issue as High. An EPSS score of < 1% indicates a very low likelihood of exploitation, but the lack of inclusion in the KEV catalog and the need for authenticated operators suggest a moderate likelihood of exploitation in environments where operators have unwarranted file read capabilities. Exploitation requires local access and valid user credentials; an attacker would craft a command containing shell metacharacters to leak file contents via the approved system.run interface.