GHSA-jqpq-mgvm-f9r6: OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)

OpenClaw previously accepted untrusted PATH sources in limited situations. In affected versions, this could cause OpenClaw to resolve and execute an unintended binary (“command hijacking”) when running host commands.

This issue primarily matters when OpenClaw is relying on allowlist/safe-bin protections and expects PATH to be trustworthy.