Openclaw cli: OpenClaw's system.run approvals did not bind mutable script operands across approval and execution (CVE-2026-32921)

The OpenClaw CLI's system.run approval mechanism did not correctly bind mutable interpreter-style script operands, such as shell scripts and scripts run via bun or deno, across the approval and execution phases. This flaw permitted a caller to obtain approval for a command like 'sh ./script.sh', then alter the script file before execution, resulting in execution of unapproved content while retaining the originally approved command arguments. Initial fixes addressed shell scripts and a limited interpreter set, but bun and deno operands remained vulnerable until a complete fix was released. The vulnerability affects OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.8, with the patch applied in 2026.3.8.

An attacker with the ability to modify script files after approval but before execution could execute arbitrary code that was not originally approved, potentially leading to unauthorized command execution and associated confidentiality, integrity, and availability impacts. The CVSS score of 6.3 reflects a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Users should upgrade OpenClaw CLI to version 2026.3.8 or later, which contains the complete fix binding approved script operands to immutable on-disk snapshots, preventing script content changes after approval. No additional mitigation is required once the update is applied.