A command injection vulnerability in the OpenClaw maintainer script allows an attacker to execute arbitrary commands on systems where the script is executed against malicious repository data.

The vulnerability is an OS command injection (CWE-78) located in the maintainer script scripts/update-clawtributors.ts. The script improperly neutralizes git author metadata before interpolating it into a shell command, allowing an attacker to inject shell metacharacters if a user or CI pipeline executes the script on a compromised repository.

The exploitation of this flaw could lead to full system compromise for developers or CI/CD environments that execute the vulnerable script. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized code execution, potential data theft, and the compromise of build pipelines or developer workstations.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later to apply the necessary sanitization patch.

Proactive Monitoring: Review CI/CD pipeline logs for unexpected command executions or unusual activity associated with the execution of update-clawtributors.ts.

Compensating Controls: Restrict the execution of repository maintenance scripts to isolated, ephemeral environments that do not have access to sensitive credentials or production infrastructure.

Public Exploit Available: Unknown

While the vulnerability is limited to specific maintenance scripts and does not impact standard CLI users, the potential for arbitrary command execution poses a significant risk to the software development lifecycle. Organizations utilizing OpenClaw for development or automated build processes must prioritize the update to version 2026.2.14 to eliminate the command injection vector.