Openclaw cli: OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion (CVE-2026-28463)

OpenClaw's exec-approvals allowlist supports a set of safe binaries intended to accept only stdin input without positional file arguments when running with host execution enabled (`tools.exec.host=gateway|node`) and security set to allowlist. The vulnerability occurs because the allowlist validation checks the command arguments before shell expansion, but the actual execution uses `sh -c`, which expands globs (e.g., `*`) and environment variables (e.g., `$HOME`). This discrepancy allows safe binaries like `head`, `tail`, or `grep` to read arbitrary local files by exploiting shell expansions, bypassing the intended stdin-only constraint. This issue is configuration-dependent and not triggered by default settings where `tools.exec.host` is `sandbox`. The vulnerability affects openclaw-cli versions from 2026.1.29 up to but not including 2026.2.14. The fix, planned for 2026.2.14, involves forcing argv tokens to be single-quoted at execution time to prevent shell expansion.

An authorized but untrusted caller or prompt injection can exploit this vulnerability to cause the gateway or node process to disclose files readable by that process. This leads to unauthorized local file disclosure when host execution is enabled in allowlist mode. The impact is limited to configurations where host execution is enabled and the allowlist mode is active. The CVSS score is 5.7 (medium severity) with high confidentiality impact but no integrity or availability impact.

A patch is available in openclaw-cli version 2026.2.14 and later that fixes the issue by forcing argv tokens to be treated as literal text during execution, preventing shell globbing and environment variable expansion. Users should upgrade to version 2026.2.14 or later once released. Until then, avoid enabling host execution with allowlist mode or restrict usage to trusted callers. The issue is not exercised by default settings, so default configurations are not vulnerable.