AI agent vulnerability · OpenClaw

CVE-2026-28470: OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

highCVSS 4.0 7.4 · 3.1 9.8GHSA-3hcm-ggvf-rch5

Summary Exec approvals allowlist bypass via command substitution/backticks inside double quotes. Affected Packages / Versions - Package: openclaw (npm) - Affected: = 2026.2.2 Impact Only affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are unaffected. Fix Reject unescaped $() and backticks inside double quotes during allowlist analysis.

Published Feb 17, 2026 · Updated Mar 6, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.2
Fixed in: 2026.2.2
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Exec approvals allowlist bypass via command substitution/backticks inside double quotes.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.1
Fixed: >= 2026.2.2

Impact

Only affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are unaffected.

Fix

Reject unescaped $() and backticks inside double quotes during allowlist analysis.

Fix Commit(s)

d1ecb46076145deb188abcba8f0699709ea17198

Thanks @simecek for reporting.

Credited to simecek, stanislavfortaisle.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries