Shell injection vulnerability in OpenClaw macOS keychain credential write
OpenClaw's Claude CLI contained a shell injection vulnerability in the macOS keychain credential refresh feature where user-controlled OAuth tokens could execute arbitrary commands. The flaw was patched by using direct process execution instead of shell command construction.
What happened
The Claude CLI keychain credential refresh path on macOS constructed a shell command to write updated JSON OAuth tokens into Keychain via 'security add-generic-password -w ...' using execSync with single-quote escaping of user-controlled data.
The single-quote escaping was insufficient to prevent shell injection because command substitution using $() or backtick expansion would be processed by the shell before quote evaluation, allowing arbitrary command execution.
Index analysis
The vulnerability was classified as High severity with CVSS score 7.6, requiring low privileges and user interaction, affecting confidentiality and integrity.
An attacker with control over an OAuth token response could execute arbitrary commands as the gateway user by injecting command substitution payloads that bypass the single-quote protection.
Governance controls
The fix replaced execSync with execFileSync to spawn the security binary directly, passing arguments as an array that are never shell-parsed, eliminating the need for quote escaping.
Regression test coverage was added to ensure shell metacharacters remain literal arguments, and new tests were created for both $() command substitution and backtick expansion payloads.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.