CVE-2026-31993
OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.
- Record
CVE-2026-31993- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - Weakness
- CWE-184
- Updated
- 2026-11-02
EUVDEUVD-2026-13025
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.
- Record
EUVD-2026-13025- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5f9p-f3w2-fwch
OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains
Summary
In the macOS companion app (currently beta), a parsing mismatch in exec approvals could let shell-chain payloads pass allowlist checks in system.run under specific settings.
Impact
This path requires all of the following:
- authenticated caller with
operator.write - paired macOS beta node host
- exec approvals set to
security=allowlistandask=on-miss
Under those conditions, a shell-chain command could be approved from an incomplete command view and then executed on the paired macOS host.
Default Install Status
Default installs are not affected.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.21-2 - Patched (planned next release):
>= 2026.2.22
Technical Details
The fix hardens macOS allowlist resolution by evaluating shell chains per segment and failing closed on unsafe shell-substitution parsing in allowlist mode.
Product Status Note
The affected macOS companion app path is currently in beta.
Fix Commit(s)
5da03e622119fa012285cdb590fcf4264c965cb5e371da38aab99521c4e076cd3d95fd775e00b784
Release Process Note
patched_versions is pre-set to the planned next npm release (2026.2.22) so once that version is published, this advisory can be published without additional metadata edits.
OpenClaw thanks @tdjackey for reporting.
- Record
GHSA-5f9p-f3w2-fwch- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-184, CWE-285
- Updated
- 2026-11-02
NVD
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.
- Record
CVE-2026-31993- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-184
- Updated
- 2026-11-02
OSV
OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.
- Record
CVE-2026-31993- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-184
- Updated
- 2026-11-02
OSVGHSA-5f9p-f3w2-fwch
OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains
Summary
In the macOS companion app (currently beta), a parsing mismatch in exec approvals could let shell-chain payloads pass allowlist checks in system.run under specific settings.
Impact
This path requires all of the following:
- authenticated caller with
operator.write - paired macOS beta node host
- exec approvals set to
security=allowlistandask=on-miss
Under those conditions, a shell-chain command could be approved from an incomplete command view and then executed on the paired macOS host.
Default Install Status
Default installs are not affected.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.21-2 - Patched (planned next release):
>= 2026.2.22
Technical Details
The fix hardens macOS allowlist resolution by evaluating shell chains per segment and failing closed on unsafe shell-substitution parsing in allowlist mode.
Product Status Note
The affected macOS companion app path is currently in beta.
Fix Commit(s)
5da03e622119fa012285cdb590fcf4264c965cb5e371da38aab99521c4e076cd3d95fd775e00b784
Release Process Note
patched_versions is pre-set to the planned next npm release (2026.2.22) so once that version is published, this advisory can be published without additional metadata edits.
OpenClaw thanks @tdjackey for reporting.
- Record
GHSA-5f9p-f3w2-fwch- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-184, CWE-285
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openclawnpm |
before 2026.2.22 | 2026.2.22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-31993 is a medium vulnerability (CVSS 5.6) in Openclaw, published March 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in openclaw 2026.2.22.
References
github.com/openclaw/openclaw/security/advisories/GHSA-5f9p-f3w2-fwch
vulncheck.com/advisories/openclaw-allowlist-parsing-mismatch-in-system-run-shell-chains
nvd.nist.gov/vuln/detail/CVE-2026-31993