Openclaw cli: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts (CVE-2026-29608)

In [email protected], the node system.run approval-path hardening rewrites the wrapper command argv, changing execution semantics. Specifically, argv[0] is rewritten to the resolved executable, causing commands like ['env','sh','-c','echo SAFE'] to become ['/bin/sh','sh','-c','echo SAFE']. This leads to the shell interpreting the extra 'sh' argument as a script path, enabling execution of a local './sh' file in the approved working directory instead of the intended shell payload. This breaks approval integrity by allowing divergence between the operator-visible command and the actual executed behavior. The vulnerability requires an attacker to influence the wrapper argv and place a local file in the approved working directory, with the operator approving the displayed command. The issue is patched in [email protected].

The vulnerability allows an attacker who can influence the wrapper argv and place a local file in the approved working directory to cause the system to execute an unintended local script instead of the approved command. This breaks the integrity of the approval process, potentially leading to execution of malicious code with the privileges of the approved command. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS score.

A fix is available and has been released in [email protected]. Users should upgrade to this version to resolve the vulnerability. No additional mitigation actions are required if the patch is applied.