CVE-2026-29610: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-29610 is a command hijacking vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.2.14. The flaw allows attackers to execute unintended binaries by manipulating PATH environment variables through node-host execution surfaces or project-local bootstrapping, bypassing allowlist/safe-bin protections. It was discovered on 2026-02-04 by researcher @akhmittra and publicly disclosed via a GitHub Security Advisory on February 15, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Feedly).

The root cause is an uncontrolled search path element (CWE-427), compounded by reliance on untrusted inputs in a security decision (CWE-807) and improper OS command neutralization (CWE-78). Two distinct attack vectors exist: (A) Node Host PATH override — an authenticated attacker with access to a system.run execution surface can pass request-scoped PATH environment overrides, causing OpenClaw to resolve a malicious binary placed earlier in PATH instead of the intended allowlisted command; (B) Project-local bootstrapping — if a victim runs OpenClaw from an attacker-controlled directory containing node_modules/.bin/ with malicious executables, those binaries are prepended to PATH and can shadow safe-bin commands. The fix commit (013e8f6) disables project-local node_modules/.bin bootstrapping by default (opt-in only via OPENCLAW_ALLOW_PROJECT_LOCAL_BIN=1, append-only), and makes the node-host ignore all request-scoped PATH overrides entirely (GitHub Advisory, Fix Commit).

Successful exploitation enables arbitrary command execution with the privileges of the OpenClaw process, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive data, modify system state, or disrupt service availability on the affected node host. In environments where OpenClaw operates with elevated privileges or has access to sensitive infrastructure, exploitation could facilitate lateral movement or full system compromise (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.05%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation of the node-host vector requires authenticated access to a system.run execution surface, limiting opportunistic exploitation; however, the project-local bootstrapping vector requires only that a victim run OpenClaw inside an attacker-controlled directory (GitHub Advisory, Feedly).

1. Reconnaissance: Identify targets running OpenClaw (npm) versions prior to 2026.2.14, either via exposed node-host execution surfaces or by identifying developers/CI pipelines that clone and run OpenClaw from external repositories.
2. Vector A — Node Host PATH Override: Obtain authenticated/authorized access to an execution surface that can invoke system.run on a connected node host (e.g., a compromised gateway or misconfigured caller).
3. Place malicious binary: On the node host, place a malicious executable in a writable directory with a filename matching an allowlisted safe-bin command (e.g., git, npm).
4. Inject PATH override: Issue a system.run request with a request-scoped PATH environment variable that places the attacker-controlled directory before legitimate system directories.
5. Trigger execution: OpenClaw resolves the command name via the manipulated PATH and executes the attacker's binary instead of the intended safe-bin command, achieving arbitrary code execution.
6. Vector B — Project-local bootstrapping: Craft a malicious repository containing node_modules/.bin/ with attacker-controlled executables named to match OpenClaw safe-bin commands. Social-engineer a victim into cloning and running OpenClaw from within this directory; OpenClaw prepends node_modules/.bin/ to PATH and executes the malicious binary (GitHub Advisory, Fix Commit).

• Process: Unexpected child processes spawned by the OpenClaw Node.js process with names matching common system utilities (e.g., git, npm, sh) but resolving to non-standard paths (e.g., /tmp/, node_modules/.bin/, attacker-controlled directories).
• File System: Presence of executables in node_modules/.bin/ with names matching allowlisted safe-bin commands that are not legitimate npm package binaries; unexpected executables in writable directories on node hosts that shadow system commands.
• Logs: OpenClaw execution logs showing commands resolved from unexpected PATH entries (e.g., paths under node_modules/.bin/ or /tmp/); system.run invocations with non-standard PATH environment variable values in request logs.
• Network: Outbound connections from the OpenClaw process to unexpected external hosts following command execution, potentially indicating reverse shell or data exfiltration activity.

Upgrade OpenClaw (npm) to version 2026.2.14 or later, which disables project-local node_modules/.bin PATH bootstrapping by default and blocks all request-scoped PATH overrides in node-host execution. For environments where immediate patching is not possible: restrict authenticated access to system.run execution surfaces; enforce strict directory permissions to prevent unauthorized writes to PATH-included directories; avoid running OpenClaw from untrusted or attacker-controlled working directories. If project-local bin support is operationally required, set OPENCLAW_ALLOW_PROJECT_LOCAL_BIN=1 only in trusted environments — this now appends rather than prepends the directory, reducing hijacking risk (GitHub Advisory, Fix Commit).

The vulnerability was assigned and disclosed by VulnCheck and published via a GitHub Security Advisory by maintainer @steipete. Community coverage has been limited but includes automated CVE tracking posts on Bluesky, Mastodon, and security aggregators such as RedPacket Security and InfinitSec. No major vendor statements or notable independent researcher commentary beyond the original advisory have been identified (GitHub Advisory).