OS Command Injection via Project Root Path in OpenClaw sshNodeCommand
OpenClaw's sshNodeCommand function contained two OS command injection vulnerabilities in its macOS application's SSH handling. Unescaped user-supplied project paths could be interpolated into shell commands, and unvalidated SSH target strings could be interpreted as configuration flags, potentially allowing arbitrary code execution.
What happened
The sshNodeCommand function in CommandResolver.swift constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host.
The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine.
Reported impact
An attacker who can influence a user's remote connection settings via social engineering or malicious configuration could achieve arbitrary code execution on either the user's local machine or their configured remote SSH host.
Index analysis
The vulnerability affected the macOS menubar application in Remote/SSH mode only. The CLI (npm install openclaw), web gateway, iOS/Android apps, and users running in Local mode were not affected.
Governance controls
The vulnerabilities were patched in version v2026.1.29, released January 31, 2026.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.