Affected: OpenClaw

OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution syntax within double-quoted text to bypass security restrictions and execute arbitrary commands on the system.

Affected: npm: openclaw

### Summary In OpenClaw's macOS node-host path, `system.run` allowlist parsing in `security=allowlist` mode failed to reject command substitution tokens when they appeared inside double-quoted shell text.

Because of that gap, payloads like `echo "ok $(id)"` could be treated as allowlist hits (first executable token `echo`) while still executing non-allowlisted subcommands through shell substitution.

### Affected Packages / Versions - Package: npm `openclaw` - Latest published affected version: `2026.2.21-2` - Affected range: `<= 2026.2.21-2` - Patched version (planned next release): `2026.2.22`

Notes: - Default installs are not affected (`security=deny` by default). - The issue requires opting into `security=allowlist` on the macOS node-host path.

### Impact Approval/authorization bypass in allowlist mode that can lead to unintended command execution on the node host.

### Preconditions - Target uses macOS node-host / companion-app execution path. - Exec approvals set to `security=allowlist`. - Ask mode is `on-miss` or `off`. - Allowlist contains a benign executable used in a shell wrapper flow (for example `/bin/echo`).

### Reproduction (example) Use a shell-wrapper command where the visible executable is allowlisted but the quoted payload contains substitution:

- command argv: `/bin/sh -lc 'echo "ok $(/usr/bin/id > /tmp/openclaw-poc-rce)"'` - allowlist pattern includes `/bin/echo`

Before the fix, allowlist analysis could resolve this as allowlisted while shell subst…