OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary c…

OpenClaw versions before 2026.3.13 contain a critical remote command injection vulnerability in the iMessage attachment staging flow. The flaw allows attackers to execute arbitrary commands on configured remote hosts by exploiting unsanitized remote attachment paths containing shell metacharacters. These malicious paths are passed directly to the SCP remote operand without proper validation. The vulnerability is only exploitable when remote attachment staging is enabled in the OpenClaw configuration. This represents a significant security risk for organizations using affected OpenClaw versions with remote attachment staging functionality.