Shell Comment Vulnerability in OpenClaw Package: Allow-Always Persistence Issue
Summary
GHSA-9q2p-vc84-2rwm: OpenClaw: system.run allow-always persistence included shell-commented payload tails. Affects openclaw versions < 2026.3.7. Fixed in 2026.3.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an npm package designed to facilitate secure command execution within applications. It employs an allowlist mechanism to control which commands can be executed, enhancing security by preventing unauthorized command execution. However, a flaw in its handling of shell comments has introduced a vulnerability that could be exploited by attackers.
Vulnerability Detail
The vulnerability arises from OpenClaw's system.run allowlist analysis, which fails to respect POSIX shell comment semantics. This allows a caller in security=allowlist mode to submit a shell command that includes a tail portion commented out with an unquoted '#'. While the shell executes only the pre-comment portion, the allowlist persistence can still analyze and store the non-executed tail as a trusted follow-up command. This could lead to unauthorized command execution and potential system compromise.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.7
This is the first release that contains the fix.
npm install openclaw@2026.3.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using unquoted '#' in your shell commands when working with OpenClaw. Ensure that any commands you submit do not contain commented-out portions that could be misinterpreted by the allowlist persistence mechanism.
Conclusion
The OpenClaw package has a vulnerability related to its handling of shell comments, which can lead to unauthorized command execution. It is crucial to update to the patched version 2026.3.7 or later to mitigate this risk. Users are also encouraged to implement temporary workarounds until they can update.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows for the storage of unexecuted shell command tails as trusted commands due to improper handling of shell comments.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 5.0, indicating a moderate level of risk.
If you cannot update the package, avoid using unquoted '#' in your shell commands as a temporary workaround.
You can find more information about OpenClaw and its functionalities on its official npm page or GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
