CVE-2026-22179

OpenClaw affected: macOS node-host system.run, versions prior to 2026.2.22. The root cause is an improper parsing of command substitution tokens that enables an allowlist bypass. Remote attackers could craft shell payloads using command substitution inside double-quoted text to execute non-allowl...