Openclaw cli: OpenClaw: system.run allow-always persistence included shell-commented payload tails

OpenClaw's system.run allowlist persistence mechanism failed to respect POSIX shell comment semantics when analyzing commands for allow-always persistence. Specifically, if a shell command included an unquoted '#' character, the runtime shell would treat the remainder of the line as a comment and not execute it, but the allowlist persistence logic would still analyze and store the commented-out tail as a trusted follow-up command. This discrepancy could allow an attacker with limited privileges to submit commands that appear safe but have appended payloads that are incorrectly trusted by the allowlist. The vulnerability affects openclaw CLI versions up to 2026.3.2 and was fixed in version 2026.3.7 by enhancing shell tokenization and chain/pipeline analysis to stop at unquoted shell comments, ensuring only executable commands are persisted.

An attacker operating in security=allowlist mode could exploit this flaw to have non-executed command tails stored as trusted allow-always persistence entries. This could lead to unintended command execution or persistence of malicious commands under the allowlist, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS score of 5.0 (medium severity) reflects the moderate impact with network attack vector, high attack complexity, low privileges required, and no user interaction needed.

A fix is available in openclaw CLI version 2026.3.7 and later. Users should upgrade to version 2026.3.7 or newer to ensure proper handling of shell comments in allow-always persistence. No additional mitigation is required as the vendor has officially fixed the issue.