GHSA-qj77-c3c8-9c3q OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

• npm openclaw: < 2026.2.2 → fixed in 2026.2.2

Summary On Windows nodes, exec requests were executed via `cmd.exe /d /s /c `. In allowlist/approval-gated mode, the allowlist analysis did not model Windows `cmd.exe` parsing and metacharacter behavior. A crafted command string could cause `cmd.exe` to interpret additional operations (for example command chaining via `&`, or expansion via `%...%` / `!...!`) beyond what was allowlisted/approved. Affected Packages / Versions • Package: `openclaw` (npm) • Affected: `= 2026.2.2` • Latest (npm) as of 2026-02-14: `2026.2.13` Details • Default installs: Not affected unless you opt into exec allowlist/approval gating on Windows nodes. • Windows execution uses `cmd.exe` via `src/infra/node-shell.ts`. • The fix hardens Windows allowlist enforcement by: • Passing the platform into allowlist analysis and rejecting Windows shell metacharacters. • Treating `cmd.exe` invocation as not allowlist-safe on Windows. • Avoiding `cmd.exe` entirely in allowlist mode by executing the parsed argv directly when possible. Fix Commit(s) • `a7f4a53ce80c98ba1452eb90802d447fca9bf3d6` Thanks @simecek for reporting.