EUVD-2026-28195Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.22.
DescriptionCVE.org
OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.
AnalysisAI
Shell expansion injection in OpenClaw's exec allowlist validation allows authenticated attackers to bypass command approval controls and execute arbitrary system commands. The vulnerability affects OpenClaw versions prior to 2026.4.22 through improper parsing of unquoted heredoc bodies, where shell expansion tokens ($VAR, $(), etc.) are treated as literal text during allowlist analysis but expanded at runtime. This enables attackers to embed unapproved commands within ostensibly safe allowlisted commands. VulnCheck disclosed this vulnerability, and a proof-of-concept fix commit is publicly available. CVSS 8.7 reflects high impact across confidentiality, integrity, and availability with low attack complexity.
Technical ContextAI
This vulnerability exploits a semantic gap between static analysis and runtime shell evaluation in OpenClaw's exec approval system, which validates commands against an allowlist before execution. The flaw (CWE-184: Incomplete List of Disallowed Inputs) occurs in the heredoc parsing logic within exec-approvals-analysis.ts. POSIX shells perform variable expansion, command substitution, and arithmetic expansion inside unquoted heredocs (<<EOF versus <<'EOF'), but OpenClaw's pre-execution analyzer incorrectly treated these expansion tokens as literal strings. An attacker could craft commands like '/usr/bin/cat <<EOF\n$MALICIOUS_VAR\nEOF' that pass allowlist validation as benign cat operations but execute arbitrary commands via $() substitution or exfiltrate environment secrets via $VAR expansion at runtime. The fix adds rejection logic for expansion forms ($VAR, $?, $$, $@, $(), ${}, $[]) in unquoted heredocs and handles line-continuation bypasses (backslash-newline sequences that could split expansion tokens across lines to evade simple pattern matching). The vulnerability affects the npm package 'openclaw' and requires authenticated access (PR:L) to submit commands for allowlist evaluation.
RemediationAI
Upgrade to OpenClaw version 2026.4.22 or later, available via npm (npm install openclaw@2026.4.22) or GitHub release tags. The fix commit b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5 (https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5) modifies exec-approvals-analysis.ts to reject POSIX parameter expansion forms ($VAR, $?, $$, $1, $@, $(), ${}, $[]) in unquoted heredocs and implements backslash-continuation-splice detection to prevent delimiter-matching bypass techniques. The vendor confirmed regression testing passed before publication. If immediate patching is infeasible, implement compensating controls: (1) Disable or restrict access to OpenClaw's exec allowlist feature until upgrade-review authentication boundaries for command submission endpoints and enforce principle of least privilege; (2) Audit existing allowlisted commands for unquoted heredocs (grep for '<<[^<]' without quotes on the delimiter) and replace with quoted heredocs (<<'DELIMITER') or remove heredoc usage entirely; (3) Enable command execution logging and monitor for unexpected shell expansion artifacts in heredoc contexts (environment variable references, command substitution patterns). Note that quoted heredocs prevent shell expansion but may break legitimate use cases expecting variable interpolation-test functionality after modification. These workarounds reduce attack surface but do not eliminate the parsing vulnerability; upgrade remains the only complete remediation. Advisory and fix details at https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today