Executive brief
OpenClaw is an AI platform that executes tasks and commands across operating systems and platforms. A vulnerability in its inline-eval security checks allows authenticated operators to bypass allowlist restrictions by combining legitimate tools with shell parameters, potentially enabling execution of unauthorized code. The impact depends on whether the affected feature is enabled and whether less-trusted users can access it.
Technical details
The vulnerability is a privilege management and authorization bypass (CWE-78, CWE-269, CWE-284, CWE-863) in OpenClaw's shell command execution and inline-eval checking logic. When the strict inline-eval feature is enabled, command requests combining allowlisted tools with shell positional arguments can be crafted to place inline-eval content in a shell carrier not covered by the strict allowlist checks. An authenticated Gateway operator with access to the affected feature and command execution surfaces can exploit this by using shell parameter expansion or similar techniques to bypass the intended allowlist rules. The fix is available in version 2026.4.2. Mitigation before patching includes avoiding allowlisting shell carrier patterns and requiring approval for shell wrappers.
Affected products
- OpenClaw openclaw < 2026.4.2
Timeline
- 2026-06-18: disclosed: GHSA-5cj2-3jr2-5h77 advisory published
- 2026-04-02: patched: Version 2026.4.2 released with patch