Command Injection Flaws Expose OpenClaw and Anthropic Claude Code to RCE

Two high-severity command injection vulnerabilities have been disclosed in developer tooling and automation software, enabling arbitrary command execution through improperly sanitized shell inputs. CVE-2026-32917 affects OpenClaw versions earlier than 2026.3.13, where the iMessage attachment staging workflow passes unsanitized remote attachment paths directly into an SCP remote operand. If remote attachment staging is enabled, an unauthenticated attacker can use shell metacharacters in attachment paths to execute commands on configured remote hosts; the flaw is tracked as CWE-78 and carries a CVSS v3.1 rating of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

A separate issue, CVE-2026-35020, impacts Anthropic Claude Code CLI and the Claude Agent SDK, where attacker-controlled input from the TERMINAL environment variable can reach /bin/sh with shell=true through the command lookup helper and deep-link terminal launcher. A local attacker can exploit the bug during normal CLI use or via the deep-link handler to run arbitrary commands with the privileges of the invoking user. Both disclosures highlight continued risk from unsanitized shell metacharacters in application workflows, with OpenClaw publishing a fixing commit and security advisory alongside third-party vulnerability reporting.