Openclaw cli: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution (CVE-2026-28460)

In OpenClaw CLI's system.run allowlist mode, an attacker can bypass shell-wrapper command allowlist analysis by splitting command substitution using a line continuation sequence ($\\ + newline + () inside double quotes). The analysis incorrectly treats the payload as allowlisted (e.g., /bin/echo), but the shell runtime folds the line continuation and executes non-allowlisted subcommands. This allows bypassing approval boundaries for command execution in affected versions (<=2026.2.21-2). The vulnerability is fixed in the planned release 2026.2.22.

This vulnerability allows attackers to bypass the system.run allowlist security mechanism in OpenClaw CLI, potentially leading to unintended command execution in environments that rely on allowlist enforcement with tools.exec.security=allowlist and ask=on-miss or off. This could undermine security controls intended to restrict command execution to approved commands.

A patch is available in the planned release version 2026.2.22; users should upgrade when it is published. As a temporary mitigation, set tools.exec.ask=always or tools.exec.security=deny to prevent bypass of the allowlist mechanism until the patch is applied.