Openclaw cli: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion (CVE-2026-53831)

On POSIX nodes, OpenClaw's system.run safe-bin checks approve commands before shell expansion, which can alter how commands are interpreted by expanding arguments into additional shell words. This can cause a command that appears safe to actually access unintended local files. The vulnerability is limited to paired POSIX node execution with safe-bin or allowlist auto-approval policies and requires an authenticated operator or agent flow. It is a policy enforcement gap in argv validation rather than a universal safe-bin command flaw. The first stable patched version is 2026.5.18.

A lower-privilege operator flow can cause an approved safe-bin command to read node-local files not intended by the policy. This may expose OpenClaw configuration data or other sensitive node-local information. The impact is confidentiality loss of local files accessible to the node process. There is no indication of privilege escalation or remote unauthenticated takeover.

Upgrade OpenClaw CLI to version 2026.5.18 or later, where this vulnerability is patched. Until upgrading, avoid broad safe-bin auto-approval for commands that can read arbitrary paths, and prefer explicit approval for node commands that access local files.