Authenticated attackers can exploit a command hijacking vulnerability in OpenClaw to achieve arbitrary command execution on the host system.

This is a command hijacking vulnerability (CWE-427) where the application improperly handles PATH environment variables. Authenticated attackers who have access to node-host execution surfaces or can control the project directory can place malicious binaries in the path to override legitimate commands.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the OpenClaw process, leading to a complete compromise of the affected environment. Given the high CVSS score of 8.8, this flaw poses a significant risk to data integrity and system availability, as an attacker could install persistent backdoors or exfiltrate sensitive project data.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later to resolve the unsafe PATH handling.

Proactive Monitoring: Review system logs for unauthorized execution of binaries from unexpected directories or unusual PATH modifications within build or execution pipelines.

Compensating Controls: Restrict access to project-local directory structures and ensure that node-host execution environments are isolated with minimal permissions to prevent unauthorized binary placement.

Public Exploit Available: No (no confirmed public exploit exists in the provided data).

This vulnerability represents a critical security risk due to the potential for arbitrary code execution. Organizations should prioritize updating their OpenClaw dependencies to version 2026.2.14 immediately to close the attack vector. Failure to patch may allow authenticated users to escalate their access and gain full control over the underlying build or execution infrastructure.