CVE-2026-32052: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32052 is a command injection vulnerability in the system.run shell-wrapper component of OpenClaw, an npm package, affecting all versions up to and including 2026.2.23. The flaw allows attackers to execute hidden commands by injecting positional argv carriers after inline shell payloads, while presenting misleading approval text to operators. It was reported by researcher @tdjackey, disclosed via GitHub Security Advisory GHSA-6rcp-vxwf-3mfp on February 25, 2026, and patched in version 2026.2.24. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is an interpretation conflict (CWE-436) and command injection (CWE-77) in OpenClaw's system.run shell-wrapper. When shell-wrapper forms such as /bin/sh -c <payload> are used, the approval and display text shown to operators was bound only to the inline shell payload (e.g., $0 "$1"), while the actual runtime execution used the full argv vector — including trailing positional arguments that could reference arbitrary executables (e.g., /usr/bin/touch /tmp/marker). This discrepancy allowed an attacker to craft a benign-looking approval prompt while silently executing arbitrary commands via the trailing argv entries, bypassing display context validation entirely. The fix introduced detection of shell-wrapper inline-command forms carrying trailing positional argv values, binding approval/display text to the full formatted argv and rejecting rawCommand values that do not match the execution-bound argv context (GitHub Advisory, Fix Commit 1, Fix Commit 2).

Successful exploitation allows an attacker to execute arbitrary OS commands on the affected system under the context of the OpenClaw process, while the operator sees only a misleading, benign-looking approval prompt. This results in high integrity and availability impact — an attacker can create, modify, or delete files, install backdoors, or disrupt system operation. The vulnerability also extends to the macOS companion exec host, where approval/display drift could similarly be exploited. Confidentiality impact at the system level is not directly indicated by the CVSS v4.0 scoring, but arbitrary command execution inherently enables data exfiltration as a secondary action (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0018 (0.18%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a system running OpenClaw npm package version <= 2026.2.23, which exposes the system.run shell-wrapper functionality.
2. Craft malicious argv: Construct a system.run invocation using a shell-wrapper form (e.g., /bin/sh -lc) where the inline payload is a positional reference such as $0 "$1", and append trailing positional argv entries pointing to the actual malicious command (e.g., /usr/bin/touch /tmp/marker or a reverse shell binary).
3. Manipulate approval text: Ensure the rawCommand field presented to the operator contains only the innocuous-looking inline payload string (e.g., $0 "$1"), which passes display context validation in vulnerable versions, while the full argv vector carries the hidden command.
4. Trigger execution: Submit the crafted command through the OpenClaw interface. The operator sees the benign approval text and may approve it, while the runtime executes the full argv including the hidden trailing positional arguments.
5. Achieve objective: The hidden command executes with the privileges of the OpenClaw process, enabling file creation/modification, data exfiltration, persistence mechanisms, or further lateral movement (GitHub Advisory, Fix Commit 1).

• Process: Unexpected child processes spawned by the OpenClaw Node.js process, particularly shell interpreters (/bin/sh, /bin/bash, /bin/dash) followed by unusual executables not matching the displayed approval text; processes like touch, curl, wget, or reverse shell utilities launched as positional argv children of shell wrappers.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the OpenClaw process; new cron jobs, startup scripts, or SSH authorized_keys modifications attributable to the OpenClaw service account.
• Logs: OpenClaw execution logs showing system.run invocations where the displayed rawCommand is a short positional reference (e.g., $0 "$1") but the full argv contains additional executable paths; audit logs recording execution of binaries not consistent with the approval text shown to operators.
• Network: Unexpected outbound connections from the OpenClaw host to external IPs shortly after system.run invocations, potentially indicating reverse shell or data exfiltration activity.

Upgrade OpenClaw (npm package) to version 2026.2.24 or later, which contains both fix commits addressing the shell-wrapper positional argv approval smuggling issue and the companion macOS exec host hardening. No configuration-based workaround is available for vulnerable versions; patching is the only remediation. Administrators should also review system logs on hosts running vulnerable versions for suspicious system.run invocations with mismatched approval text and argv vectors (GitHub Advisory, Fix Commit 1, Fix Commit 2).

The vulnerability was reported by researcher @tdjackey, who also identified several other security issues in OpenClaw around the same time period, including sandbox escape and allowlist bypass vulnerabilities. The GitHub Security Advisory was published by maintainer @steipete and rated as Moderate severity. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory).