Executive brief
OpenClaw is an open-source interpreter for script execution that includes a security feature to block unsafe script content before it runs. A flaw in this preflight validation allows attackers to bypass this protection by using complex command forms such as pipes or command substitution, potentially executing malicious scripts that should have been blocked. This weakens the security safeguards intended to prevent arbitrary code execution.
Technical details
The vulnerability is a validation bypass (CWE-184: Incomplete List of Disallowed Inputs) in the validateScriptFileForShellBleed() function that protects against shell-bleed attacks. The parser fails to properly recognize and validate complex interpreter invocations such as piped commands, command substitution, or subshell invocations, allowing attackers to craft commands that evade the preflight checks. The validation is a fail-open mechanism—when the parser cannot recognize a command form, it skips validation entirely rather than blocking the command. An authenticated attacker can trigger this by submitting complex command shapes to bypass the defense-in-depth guard. The vulnerability is fixed in OpenClaw 2026.4.2 (commit 8aceaf5).
Affected products
- OpenClaw OpenClaw before 2026.4.2
Timeline
- 2026-04-02: disclosed
- 2026-04-02: patched: Fix committed; patch scheduled for version 2026.4.2