EUVD-2026-37157
GHSA-27pq-2ph8-8x25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as OpenClaw operator
-
DeliveryIdentify allowlisted tools and shell carrier
-
ExploitCraft invocation with positional-parameter payload
-
ExecutionSubmit to inline-eval allowlist check
-
PersistShell expands smuggled inline-eval content
-
ImpactExecute unapproved commands in operator context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
|
| Exploitation Conditions | Exploitation requires (1) an authenticated OpenClaw operator account (PR:L), (2) an OpenClaw instance running a version before 2026.4.2 with the inline-eval allowlist enforcement enabled, and (3) the attacker crafting a command that combines an allowlisted tool with shell positional parameters ($1/$2/$@/etc.) carrying inline-eval payloads - this is the specific attack requirement reflected by AT:P. Exploitation is limited by the need for valid operator credentials and by the attacker having to know which tools are allowlisted and how the shell carrier expands positional arguments; no user interaction is required (UI:N) and the network attack vector (AV:N) means any reachable OpenClaw operator endpoint suffices. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N indicates network-reachable exploitation by an already-authenticated operator with low complexity but a specific attack requirement (the targeted allowlist/eval path), yielding high confidentiality and integrity impact and no availability impact - consistent with code/command smuggling rather than a crash. The PR:L requirement materially lowers real-world risk: only insiders or attackers who have already compromised an operator account can exploit it, which generally aligns with targeted abuse rather than mass exploitation. EPSS, KEV listing and SSVC decision-framework data were not provided in the input, and no public PoC is referenced, so likelihood signals beyond CVSS are unknown; the VulnCheck advisory and GHSA suggest researcher attention but not in-the-wild activity. Net: prioritize as a high-impact insider/post-auth bug, not an emergency mass-exploitation event, but patch promptly on any multi-tenant or shared-operator OpenClaw deployment. |
| Exploit ScenarioDerived | An authenticated OpenClaw operator (legitimate insider or attacker with stolen operator credentials) invokes an allowlisted tool but passes shell positional parameters as arguments that carry inline-eval content the allowlist check never sees. When the shell carrier expands those positional parameters, the smuggled content runs as unapproved shell-provided code in OpenClaw's execution context, giving the attacker arbitrary command execution within the operator's privilege scope. No public exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Allowlist bypass in OpenClaw before 2026.4.2 lets authenticated operators smuggle inline-eval content through shell positional parameters, defeating the strict allowlist that is meant to constrain which tools and content the shell carrier executes. Successful abuse yields execution of unapproved shell-provided content with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade OpenClaw to 2026.4.2 or later, per the project GHSA-5cj2-3jr2-5h77 advisory. Until the upgrade is rolled out, restrict operator credentials to trusted users and audit operator-supplied tool invocations for shell positional parameter usage ($1, $2, $@, $*, ${n}) in arguments to allowlisted tools, since the bug requires those constructs to smuggle inline-eval content; rejecting or stripping positional-parameter tokens from operator inputs blocks the known bypass but will break any legitimate workflow that relies on positional expansion. Tightening the allowlist to refuse argument strings containing unescaped shell metacharacters provides additional defense-in-depth at the cost of legitimate command flexibility, and operator action logs should be reviewed for prior abuse before patching. Cross-reference the VulnCheck write-up (https://www.vulncheck.com/advisories/openclaw-shell-positional-parameters-bypass-in-inline-eval-checks) for indicators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw enforces a strict allowlist over the tools and inline-eval content that can be passed to a shell carrier. The vulnerability is an instance of CWE-184 (Incomplete List of Disallowed Inputs): the allowlist matcher inspects the explicit tool arguments but does not account for shell positional parameters ($1, $2, $@, etc.), which the shell expands at runtime. By combining an allowlisted tool invocation with positional arguments that carry attacker-controlled inline-eval payloads, the eval content rides into the shell carrier outside the allowlist's intended rule scope. The CPE confirms the impact is scoped to the openclaw:openclaw package itself, with the broken check living in the inline-eval/allowlist enforcement path rather than in the underlying shell.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable post-auth operator (PR:L); crafting a positional-parameter bypass of an allowlist is a non-trivial attack condition (AC:H); arbitrary command smuggling yields C:H/I:H but no stated availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.
Blast Radius
ecosystem impact- 5 npm packages depend on openclaw (5 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.2.
Executive ViewAI
OpenClaw before version 2026.4.2 contains an allowlist bypass vulnerability that enables authenticated operators to execute unapproved shell commands, creating risk of unauthorized data access and system modification. This affects organizations that depend on OpenClaw's access controls to prevent privileged shell operations.
Restrict operator role assignment to essential personnel only; implement comprehensive logging and alerting for all operator shell command activity; apply network segmentation to limit lateral movement from compromised operator accounts; monitor vendor advisories and deploy patched version immediately upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB