Openclaw cli: OpenClaw: Exec approval display truncation could hide the command being approved (CVE-2026-53829)

OpenClaw CLI's exec approval feature truncates the display of very long commands in the approval UI, showing only a shortened prefix while the full command, including a hidden suffix, executes after approval. This discrepancy can mislead approvers into authorizing commands without full visibility of their content. The vulnerability impacts configurations where exec approval is enabled and authenticated users can submit long commands. It does not grant exec access to unauthenticated users nor alter the local-first trust model. The issue is an approval integrity problem, potentially allowing unintended shell operations to run post-approval. The vulnerability is patched in OpenClaw CLI version 2026.5.18.

An attacker or user who can submit long exec commands for approval could cause an approver to authorize a command based on incomplete information, as the approval UI truncates the command display. This may lead to execution of hidden shell operations included in the command suffix after approval. The severity depends on the roles allowed to request and approve exec commands. The vulnerability compromises the integrity of the approval process but does not elevate privileges or bypass authentication.

Upgrade OpenClaw CLI to version 2026.5.18 or later, where the issue is fixed. Until upgrading, avoid approving unusually long exec commands and restrict approval permissions to trusted operators only.