N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6rcp-vxwf-3mfp

GHSA-6rcp-vxwf-3mfp: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

Summary

In openclaw up to and including 2026.2.23 (latest npm release as of February 25, 2026), system.run shell-wrapper inputs could present misleading approval/display text while still carrying hidden positional argv payloads that execute at runtime.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.23
Patched: >= 2026.2.24 (planned next release)

Root Cause

For shell-wrapper forms (for example /bin/sh -c ...), command-text binding could focus on inline shell payload text while runtime execution still used the full argv vector. Positional argv carriers after the inline payload could therefore be executed under incomplete display context.

Security Impact

Approval/display context could omit executed argv carriers, enabling hidden command execution under misleading operator-visible text.

Fix

Detect shell-wrapper inline-command forms that carry trailing positional argv values.
Bind approval/display command text to full formatted argv for those carrier forms.
Reject payload-only rawCommand values when they do not match the execution-bound argv context for those forms.
Forward canonical command display text to the macOS companion exec host and validate rawCommand/argv consistency there for carrier wrappers and env-modifier shell preludes.

Verification

pnpm check
pnpm exec vitest run --config vitest.gateway.config.ts
pnpm test:fast
pnpm vitest run src/infra/system-run-command.test.ts src/node-host/invoke-system-run.test.ts src/cli/nodes-cli.coverage.test.ts src/gateway/node-invoke-system-run-approval.test.ts
cd apps/macos && swift test --filter ExecSystemRunCommandValidatorTests

Fix Commit(s)

0f0a680d3df81739ea5088a2f88e65f938b7936b
55cf92578d266987e390c4bf688196af98eac748

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.24) so after npm publish the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

Publication Update (2026-02-25)

openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-6rcp-vxwf-3mfp

GHSA-6rcp-vxwf-3mfp:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.23	2026.2.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-6rcp-vxwf-3mfp, allows for hidden command execution in OpenClaw's system.run function. The root cause is a discrepancy between the command string displayed to the user for approval and the actual command arguments (argv) that are executed. This is particularly problematic with shell wrappers (e.g., /bin/sh -c '...') where an attacker can provide a seemingly benign inline script for the approval text, while hiding malicious commands in subsequent positional arguments.

The analysis of the two fix commits (0f0a680d3df81739ea5088a2f88e65f938b7936b and 55cf92578d266987e390c4bf688196af98eac748) reveals that the vulnerability affected both the main Node.js application and its macOS companion execution host.

In the Node.js part, the functions resolveSystemRunCommand and validateSystemRunCommandConsistency in src/infra/system-run-command.ts were flawed. resolveSystemRunCommand generated an incomplete display text for approval, and validateSystemRunCommandConsistency failed to detect the mismatch between this incomplete text and the full command line. The function handleSystemRunInvoke then propagated this misleading information to the macOS companion.

In the macOS companion app, the ExecHostExecutor.execute function in apps/macos/Sources/OpenClaw/ExecApprovalsSocket.swift blindly trusted the command string it received, displaying it for approval without independent validation.

The fix involves two main changes: 1) The Node.js code was updated to always bind the approval/display text to the full, formatted argv string for these shell-wrapper forms. 2) The macOS companion app now performs its own validation to ensure the command it displays for approval is consistent with the one that will be executed.

Vulnerable functions

validateSystemRunCommandConsistency

src/infra/system-run-command.ts

This function was responsible for validating the consistency between the user-provided `rawCommand` and the actual command arguments (`argv`). Before the patch, it failed to account for shell-wrapper commands that carry additional positional arguments, incorrectly inferring the command to be validated. This allowed a malicious actor to craft an `argv` that would execute hidden commands not visible in the `rawCommand` used for approval.

resolveSystemRunCommand

src/infra/system-run-command.ts

This function resolves the command arguments into a display-friendly text (`cmdText`) that is shown to the user for approval. The vulnerability existed because this function would only use the inline shell payload as the `cmdText`, omitting any subsequent positional arguments. An attacker could place malicious commands in these omitted arguments, which would be executed without the user's knowledge or explicit approval. The patch ensures the `cmdText` includes the full command-line string.

handleSystemRunInvoke

src/node-host/invoke-system-run.ts

This function handles the invocation of `system.run` and communicates with the macOS companion app for execution approval. It was vulnerable because it forwarded the potentially incomplete `rawCommand` or `shellCommand` to the companion app. This propagated the vulnerability, causing the macOS approval prompt to also display a misleading command, rather than the full, canonical command text (`cmdText`) that is actually executed.

ExecHostExecutor.execute

apps/macos/Sources/OpenClaw/ExecApprovalsSocket.swift

This function in the macOS companion app is responsible for processing the execution request and showing an approval UI. It was vulnerable because it trusted the `rawCommand` received from the Node.js host and used it to build the approval context, without performing its own validation. This meant that a misleading command from the host would be presented to the user for approval on macOS. The patch introduces a call to `ExecSystemRunCommandValidator.resolve` to ensure the command is validated on the companion side as well.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-6rcp-vxwf-3mfp: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

Summary

Affected Packages / Versions

Root Cause

Security Impact

Fix

Verification

Fix Commit(s)

Release Process Note

Publication Update (2026-02-25)

GHSA-6rcp-vxwf-3mfp:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Basic Information

Basic Information

GHSA-6rcp-vxwf-3mfp: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

Summary

Affected Packages / Versions

Root Cause

Security Impact

Fix

Verification

Fix Commit(s)

Release Process Note

Publication Update (2026-02-25)

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI