Openclaw cli: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains (CVE-2026-31993)

The OpenClaw CLI macOS companion app (beta) contains a vulnerability (CVE-2026-31993) where a parsing mismatch in exec approvals can allow shell-chain commands to pass allowlist checks improperly in the system.run function. This occurs only when the caller is authenticated with operator.write privileges, the macOS node is in beta, and exec approvals are set to security=allowlist and ask=on-miss. The vulnerability enables execution of shell-chain commands from an incomplete command view on the paired macOS host. The fix involves hardening allowlist resolution by evaluating shell chains segment-by-segment and failing closed on unsafe shell-substitution parsing. The vulnerability affects openclaw npm package versions up to 2026.2.21-2 and is planned to be patched in version 2026.2.22.

An authenticated user with operator.write permissions on a paired macOS beta node can execute shell-chain commands that bypass allowlist checks under specific exec approval settings. This could lead to unauthorized command execution on the macOS host. Default installations are not affected, limiting exposure to beta users with specific configurations.

A patch is available and planned for the next release version 2026.2.22. Users running affected versions (<=2026.2.21-2) should upgrade to version 2026.2.22 or later once released. Since this vulnerability affects only the beta macOS companion app with specific exec approval settings, users not meeting these conditions are not impacted. No additional mitigation is required beyond applying the official fix when available.