Command injection in OpenClaw maintainer clawtributors updater
OpenClaw's maintainer script for updating contributors contained a command injection vulnerability that could allow arbitrary command execution through maliciously crafted git commit author emails. The vulnerability affected source checkouts but not normal CLI usage, and was patched in version 2026.2.14.
What happened
The maintainer script scripts/update-clawtributors.ts in OpenClaw derived a GitHub login from git log author metadata and interpolated it into a shell command via execSync. A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run.
Reported impact
The vulnerability affects contributors and maintainers (or CI) who run bun scripts/update-clawtributors.ts in a source checkout containing a malicious commit author email. Normal CLI usage is not affected as the script is not part of the shipped CLI and is not executed during routine operation.
Index analysis
The command injection occurs in the maintainer/dev script that processes untrusted commit metadata without proper sanitization. The script was patched in version 2026.2.14 with hardened validation of login values.
Governance controls
OpenClaw released a fix (commit a429380e337152746031d290432a4b93aa553d55) that hardens the clawtributors updater against command injection via untrusted commit metadata.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.