Openclaw cli: OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE) (CVE-2026-32003)

The OpenClaw CLI system.run function allowed injection of the SHELLOPTS and PS4 environment variables, which are evaluated by bash during xtrace expansion when running shell wrappers with -c or -lc options. This bypasses the allowlist mechanism intended to restrict command execution, enabling attackers who can invoke system.run with request-scoped environment variables to execute arbitrary shell commands outside the allowlisted command body. The root cause is incomplete environment sanitization that blocked common startup-file vectors but did not block SHELLOPTS and PS4. The fix involves blocking these variables and limiting environment overrides to a strict allowlist.

An attacker with the ability to invoke system.run with request-scoped environment variables can execute arbitrary shell commands beyond the intended allowlist restrictions. However, exploitation requires existing privileges to call system.run, which under OpenClaw's trust model means the attacker is already a trusted operator. Therefore, the vulnerability does not cross a separate trust boundary and is rated medium severity.

A fix is available and planned for release in OpenClaw CLI version 2026.2.22. The patch blocks the SHELLOPTS and PS4 environment variables in the host execution environment sanitizers and restricts environment overrides to an explicit allowlist of safe variables. Users should upgrade to version 2026.2.22 once it is published. Until then, be aware that the vulnerability requires the ability to invoke system.run with environment overrides.