A vulnerability in the OpenClaw npm package versions 2026.2.23 up to but not including 2026.4.12 weakens the exec approval binding for opaque multi-call binaries such as busybox and toybox. This flaw allows these binaries to obscure which applet or script-like behavior is executed, potentially leading to incorrect risk classification. The issue was fixed in version 2026.4.12 and later.