RuleId: CVE-2026-28460
RuleDesc: CVE context for keyword 'OpenClaw' // CWE info: CWE-78 (OS Command Injection)

Vuln Description:
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run
that allows attackers to execute non-allowlisted commands by splitting command substitution
using shell line-continuation characters. Attackers can bypass security analysis by injecting
$\\ followed by a newline and opening parenthesis inside double quotes, causing the shell to
fold the line continuation into executable command substitution that circumvents approval
boundaries.

Metadata:
- Repository hint: https://github.com/openclaw/openclaw
- Published at: 2026-03-19T02:16:02.603
- Severity: HIGH (score=8.8)
- Affected summary: openclaw:openclaw <2026.2.22

Related Files:
Use CT-graph history, commit metadata, and referenced URLs to identify the exact files,
functions, or symbols that introduced and later fixed this vulnerability in the target repository.

Reference URLs (from CVE dataset):
- [01] https://github.com/openclaw/openclaw/commit/3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9
- [02] https://github.com/openclaw/openclaw/security/advisories/GHSA-9868-vxmx-w862
- [03] https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-shell-line-continuation-command-substitution-in-system-run