Affected: Homebrew: openclaw-cli

### Summary A Windows `system.run` approval-integrity mismatch in the `cmd.exe /c` path could allow trailing arguments to execute while approval/audit text reflected only a benign command string.

This requires an authenticated operator context using the approvals flow and a trusted Windows node.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published vulnerable version (as of 2026-02-21): `2026.2.19-2` - Vulnerable range: `<=2026.2.19-2` - Patched version (planned next release): `2026.2.21`

### Attack Scenario 1. An authenticated operator approval is created for a benign command text (for example, `echo`). 2. A `system.run` request uses `cmd.exe /c` with extra trailing arguments. 3. Prior behavior could bind approval/audit text to the benign command while still executing the full argument tail on the node.

### Impact - Local command execution on the trusted Windows node process account. - Approval/audit command text integrity mismatch.

### Fix - Canonicalize the full command tail after `cmd.exe /c`. - Reuse one shared command canonicalization/validation path for validation, approval matching, and execution/audit text. - Add regression coverage for trailing-argument smuggling and approval binding.

### Fix Commit(s) - `6007941f04df1edcca679dd6c95949744fdbd4df`

### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is live, this advisory can be published directly.

OpenClaw thanks @t…

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments through cmd.exe /c to achieve local command execution on trusted Windows nodes with mismatched audit logs.

Affected: npm: openclaw

### Summary A Windows `system.run` approval-integrity mismatch in the `cmd.exe /c` path could allow trailing arguments to execute while approval/audit text reflected only a benign command string.

This requires an authenticated operator context using the approvals flow and a trusted Windows node.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published vulnerable version (as of 2026-02-21): `2026.2.19-2` - Vulnerable range: `<=2026.2.19-2` - Patched version (planned next release): `2026.2.21`

### Attack Scenario 1. An authenticated operator approval is created for a benign command text (for example, `echo`). 2. A `system.run` request uses `cmd.exe /c` with extra trailing arguments. 3. Prior behavior could bind approval/audit text to the benign command while still executing the full argument tail on the node.

### Impact - Local command execution on the trusted Windows node process account. - Approval/audit command text integrity mismatch.

### Fix - Canonicalize the full command tail after `cmd.exe /c`. - Reuse one shared command canonicalization/validation path for validation, approval matching, and execution/audit text. - Add regression coverage for trailing-argument smuggling and approval binding.

### Fix Commit(s) - `6007941f04df1edcca679dd6c95949744fdbd4df`

### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is live, this advisory can be published directly.

OpenClaw thanks @t…

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.