N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qj77-c3c8-9c3q

GHSA-qj77-c3c8-9c3q: OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

Summary

On Windows nodes, exec requests were executed via cmd.exe /d /s /c <rawCommand>. In allowlist/approval-gated mode, the allowlist analysis did not model Windows cmd.exe parsing and metacharacter behavior. A crafted command string could cause cmd.exe to interpret additional operations (for example command chaining via &, or expansion via %...% / !...!) beyond what was allowlisted/approved.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.1
Patched: >= 2026.2.2
Latest (npm) as of 2026-02-14: 2026.2.13

Details

Default installs: Not affected unless you opt into exec allowlist/approval gating on Windows nodes.
Windows execution uses cmd.exe via src/infra/node-shell.ts.
The fix hardens Windows allowlist enforcement by:
- Passing the platform into allowlist analysis and rejecting Windows shell metacharacters.
- Treating cmd.exe invocation as not allowlist-safe on Windows.
- Avoiding cmd.exe entirely in allowlist mode by executing the parsed argv directly when possible.

Fix Commit(s)

a7f4a53ce80c98ba1452eb90802d447fca9bf3d6

Thanks @simecek for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qj77-c3c8-9c3q

GHSA-qj77-c3c8-9c3q:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.2	2026.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the command execution feature on Windows nodes did not properly account for the parsing behavior of cmd.exe. When the exec allowlist was enabled, a user could craft a command with special metacharacters (like & or |) to bypass the security checks. The core of the issue was in the analyzeShellCommand function, which used a POSIX-style shell parser that was unaware of Windows-specific metacharacters. This led to incorrect validation by the evaluateShellAllowlist function. The handleInvoke function would then take the improperly validated raw command and execute it using cmd.exe, allowing the embedded malicious commands to run. The patch addresses this by introducing platform-specific command parsing that explicitly disallows Windows shell metacharacters, blocking cmd.exe invocations in allowlist mode, and executing parsed arguments directly to avoid the shell.

Vulnerable functions

handleInvoke

src/node-host/runner.ts

Before the patch, `handleInvoke` would pass the raw command string to `runCommand`, which on Windows would execute it via `cmd.exe`. This allowed for command injection through shell metacharacters (e.g., `&`, `|`). The patch introduces logic to bypass `cmd.exe` when in allowlist mode by executing the parsed and validated arguments directly.

analyzeShellCommand

src/infra/exec-approvals.ts

The original implementation of `analyzeShellCommand` used a single parsing logic for all platforms, which was not safe for Windows `cmd.exe`. It failed to recognize Windows-specific shell metacharacters, leading to incorrect parsing and allowlist bypass. The patch adds platform-specific logic, calling `analyzeWindowsShellCommand` for Windows, which correctly identifies and rejects malicious characters.

evaluateShellAllowlist

src/infra/exec-approvals.ts

This function relied on the output of `analyzeShellCommand` to validate commands against an allowlist. Because `analyzeShellCommand` was vulnerable on Windows, `evaluateShellAllowlist` would receive incorrect analysis and approve commands that should have been rejected. The patch ensures this function is platform-aware by passing the platform down to the analysis function and disabling command chain splitting on Windows.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.