PT-2026-27235 · Openclaw · Openclaw

Tdjackey · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32901

Mitre

CVSS v3.1

6.7

Medium

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

OpenClaw before 2026.3.2 contains a semantic drift vulnerability in node system.run approval hardening that rewrites wrapper command argv, allowing execution of unintended local scripts. Attackers who can influence wrapper argv and place malicious files in the approved working directory can execute arbitrary scripts by exploiting argv rewriting that changes runtime behavior from approved command text.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-32901

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/dded569626b0d8e7bdab10b5e7528b6caf73a0f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32901 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h3rm-6x7g-882f · Note
• https://vulncheck.com/advisories/openclaw-mar-arbitrary-local-script-execution-via-system-run-wrapper-argv-rewriting · Note