Threats affecting pkg:github/OpenClaw Windows Node

OpenClaw Windows Node versions before 2026.7.1 have an incomplete environment-variable sanitizer in the system.run function. This flaw fails to block certain environment variables (GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, JAVA_TOOL_OPTIONS), which attackers with gateway or agent access can exploit to execute arbitrary code by influencing allowlisted tools such as git, dotnet, or java.

OpenClaw Windows Node versions up to 2026.9.4 contain a server-side request forgery (SSRF) vulnerability in the canvas.present capability. This flaw allows attackers with gateway or agent access to bypass URL risk evaluation and make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity.

OpenClaw Windows Node versions before 2026.7.1 have a vulnerability in the system.execApprovals.set function that allows remote callers to add overly broad allow rules. This flaw arises from incomplete validation of disallowed inputs, including wildcard-executable rules and certain system binaries like mshta, rundll32, and certutil. Exploiting this, an attacker with limited privileges can execute arbitrary commands on the Windows host without operator checks or user prompts.

OpenClaw Windows Node versions before 2026.7.1 have a vulnerability in the gateway WebSocket transport that allows resource allocation without limits. This flaw enables connected gateways to send an unending sequence of WebSocket continuation frames without the EndOfMessage flag, causing unbounded memory growth and eventual node process crash.

OpenClaw Windows Node versions before 2026.7.1 have an incorrect authorization vulnerability in the exec-approval policy. The vulnerability arises because the ExecShellWrapperParser does not properly parse commands containing pipe operators or command substitutions. This allows connected gateways or agents to bypass approval rules by hiding denied commands behind allowed prefixes, enabling arbitrary command execution on affected Windows hosts.

OpenClaw Windows Node versions before 2026.7.1-3 have a missing authorization vulnerability in NodeService capture handlers. This flaw allows connected gateways or agents to perform screen snapshots, camera captures, and location retrievals without user consent or prompts. Attackers can silently invoke these functions over the node WebSocket interface, compromising user privacy without interaction.