GHSA-2j8v-hwgc-x698: OpenClaw: Shell wrapper argv could change between approval and execution

OpenClaw approves exec requests by resolving them to an argv and comparing that against an allowlist or an operator approval. With shell wrapper forms, such as a command passed through a shell with its own arguments, the argv that was approved and the argv that was rebuilt for execution could differ. That is a gap between check and use. The advisory classes it as improper access control (CWE-284).

The attacker is an authenticated operator or an agent flow that can submit command requests. They craft a wrapper-form request whose approved shape looks allowed but whose executed shape is something else. The outcome is a command that was never checked against the allowlist, running with the privileges of the OpenClaw process. The vector gives high confidentiality, integrity and availability impact with low privileges.

The advisory keeps the trusted-operator model unchanged and says real exposure depends on configuration and on whether lower-trust input can reach the path. The advisory does not give the wrapper syntax or the code change. Teams that let agents or shared users run commands under durable allowlists are the main concern.

The npm package openclaw at 2026.5.16 and earlier, where exec allowlists or approvals cover shell wrapper commands and the feature is reachable by operators or agent flows.

npm ls openclaw

Use npm ls -g openclaw for a global install. The advisory data spells the package name Openclaw; the npm package is openclaw.

Upgrade to [email protected], the first stable patched version:

npm install [email protected]

Until then, the advisory says to require explicit approval for shell wrappers and avoid durable allowlists for wrapper-heavy commands. It also advises narrow channel and tool allowlists, not sharing one Gateway between mutually untrusted users, and disabling the exec feature when unneeded.

Compare approved exec requests with the commands that actually ran. Look for process launches by the OpenClaw process, especially shell invocations with arguments that differ from the approval record. Review any durable allowlist entries for shell wrappers, since those are the ones this flaw bypasses. The advisory gives no log string. Beam records agent shell commands as they execute, so it can show what ran and not only what was approved.

Summary

Shell wrapper argv could change between approval and execution. In affected versions, a command request using a shell wrapper form could approve one resolved argv shape and rebuild another for execution.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could run a command shape that was not checked against the allowlist. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.18.

Mitigations

require explicit approval for shell wrappers and avoid durable allowlists for wrapper-heavy commands until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.