CVE-2026-22179 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.22 in macOS node-host system.run contains a command injection caused by improper parsing of command substitution tokens, letting remote attackers execute arbitrary commands by bypassing allowlist, exploit requires crafted shell payloads with command substitution syntax.

Severity & Score

Impact

Remote attackers can execute arbitrary commands on the system, potentially leading to full system compromise.

Mitigation

Update to version 2026.2.22 or later.

References

• https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-command-substitution-in-system-run
• https://github.com/openclaw/openclaw/commit/90a378ca3a9ecbf1634cd247f17a35f4612c6ca6
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9p38-94jf-hgjj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner