Openclaw cli: OpenClaw: busybox and toybox applet execution weakened exec approval binding (CVE-2026-43530)

The openclaw-cli package versions >=2026.2.23 and <2026.4.12 contain a vulnerability (CVE-2026-43530) where the execution approval binding for opaque multi-call binaries like busybox and toybox is weakened. These binaries can obscure which applet or script-like behavior is actually executed, undermining exec approval and risk classification. The fix, implemented in PR #65713 and commit 666f48d9b882a8a1415ca53f9567c72499d850c9, treats busybox and toybox as opaque mutable script runners and fails closed rather than binding unsafe applet invocations. This correction improves security by preventing unsafe execution paths.

The vulnerability allows obscured execution of applets or scripts via busybox and toybox binaries, weakening exec approval binding. This can lead to unauthorized or unexpected code execution, impacting confidentiality, integrity, and availability of affected systems. The CVSS 3.1 score is 8.8 (high severity) reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available and users should upgrade openclaw-cli to version 2026.4.12 or later. The latest npm release 2026.4.14 includes the fix. No additional mitigation steps are required beyond applying the official patch.