Submit #875795: OpenClaw openclaw <= 2026.5.7 Incomplete List of Disallowed Inputs (CWE-184)

# Technical Details
A host command-execution approval bypass exists in the PowerShell wrapper parsing logic used by `system.run` in OpenClaw.

The parser recognizes only a fixed set of PowerShell inline-command flags in `src/infra/shell-inline-command.ts`. It omits the valid PowerShell encoded-command abbreviation `-ec`. Because `src/infra/shell-wrapper-resolution.ts` relies on this list, a command such as `pwsh -ec <base64>` is not classified as carrying an inline payload. The allowlist path can then evaluate only the outer `pwsh` or `powershell` executable instead of the embedded script.

# Vulnerable Code
File: src/infra/shell-inline-command.ts
Method: POWERSHELL_INLINE_COMMAND_FLAGS
Why: The allowed inline-command flag set includes forms such as `-EncodedCommand`, `-enc`, and `-e`, but omits `-ec`, even though PowerShell accepts it as an encoded-command abbreviation.

File: src/infra/shell-wrapper-resolution.ts
Method: extractPowerShellInlineCommand
Why: Payload extraction delegates to the incomplete flag set, so `pwsh -ec <payload>` returns no extracted shell payload.

File: src/node-host/invoke-system-run-allowlist.ts
Method: allowlist evaluation for system.run argv
Why: When no shell payload is extracted, the command can fall back to ordinary executable allowlist matching.

# Reproduction
1. Run an affected OpenClaw deployment with host exec approvals in allowlist mode.
2. Add `pwsh` or `powershell` to the effective executable allowlist.
3. Submit a `system.run` request through an OpenClaw execution surface using argv similar to `["pwsh", "-ec", "<UTF-16LE-base64-payload>"]`.
4. Observe that the parser reports no extracted shell payload for `-ec`.
5. Observe that the inner PowerShell script can execute under the allowlisted wrapper instead of being inspected as an inline command.

# Impact
- Arbitrary PowerShell payload execution when PowerShell is allowlisted.
- Bypass of intended inline-script approval checks.
- Possible exposure of source code, environment variables, local secrets, service tokens, CI materials, SSH keys, and other data accessible to the OpenClaw process.

Reference Link : https://gist.github.com/YLChen-007/153258d7c20e5274156a3186eb8940ed ;

• Source: ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-j472-gf56-x589
• User: AbamaYouLong (UID 99186)
• Submission: 07/01/2026 08:28 (2 months ago)
• Moderation: 08/17/2026 11:45 (2 months later)
• Status: Duplicate
• VulDB entry: 370743 [OpenClaw up to 2026.5.11 Allowlist Parser incomplete blacklist]
• Points: 0