GHSA-9p38-94jf-hgjj OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution

• npm openclaw: < 2026.2.22 → fixed in 2026.2.22

Summary In OpenClaw's macOS node-host path, `system.run` allowlist parsing in `security=allowlist` mode failed to reject command substitution tokens when they appeared inside double-quoted shell text. Because of that gap, payloads like `echo "ok $(id)"` could be treated as allowlist hits (first executable token `echo`) while still executing non-allowlisted subcommands through shell substitution. Affected Packages / Versions • Package: npm `openclaw` • Latest published affected version: `2026.2.21-2` • Affected range: ` /tmp/openclaw-poc-rce)"'` • allowlist pattern includes `/bin/echo` Before the fix, allowlist analysis could resolve this as allowlisted while shell substitution still executed. Remediation • Upgrade to `2026.2.22` (or newer) when released. • Temporary mitigation: set ask mode to `always` or set security mode to `deny`. Fix Commit(s) • `90a378ca3a9ecbf1634cd247f17a35f4612c6ca6` Release Process Note `patched_versions` is pre-set to planned next release `2026.2.22`. After npm release is out, advisory can be published directly. OpenClaw thanks @tdjackey for reporting.