EUVD-2026-12724
GHSA-9p38-94jf-hgjj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution syntax within double-quoted text to bypass security restrictions and execute arbitrary commands on the system.
AnalysisAI
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the macOS node-host system.run function that permits remote attackers with high privileges to execute arbitrary commands by exploiting improper parsing of command substitution tokens. Attackers can craft malicious shell payloads using command substitution syntax within double-quoted strings to circumvent security allowlists and achieve code execution. A patch is available from the vendor, and the vulnerability has been documented by VulnCheck with public advisory and GitHub security advisory references.
Technical ContextAI
The vulnerability resides in OpenClaw's system.run function (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), which is responsible for executing shell commands on macOS node-host systems. The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), stemming from inadequate validation of command substitution syntax. The allowlist mechanism intended to restrict executable commands fails to properly parse and neutralize shell metacharacters, particularly command substitution operators (backticks and $() syntax) when embedded within double-quoted strings. This parsing weakness allows attackers to nest unauthorized commands within what appears to be allowlisted command text, causing the shell to execute the substituted payload. The vulnerability affects the macOS platform specifically, indicating OS-level command execution through improper shell parameter expansion handling.
RemediationAI
Upgrade OpenClaw to version 2026.2.22 or later immediately. The vendor has released a patch available at https://github.com/openclaw/openclaw/commit/90a378ca3a9ecbf1634cd247f17a35f4612c6ca6 and full advisory guidance at https://github.com/openclaw/openclaw/security/advisories/GHSA-9p38-94jf-hgjj. Until patching can be completed, restrict execution of system.run function to only trusted, low-privilege service accounts and implement network segmentation to limit who can access macOS node-host systems running vulnerable OpenClaw versions. Audit command execution logs for any evidence of command substitution syntax in arguments passed to system.run. Apply the patch during your next maintenance window; given the high privilege requirement, this is not a drop-everything emergency but should be prioritized within standard patching schedules.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today