Executive brief
OpenClaw is a command orchestration tool that enforces strict rules about which shell commands and tools authenticated operators can execute. This vulnerability allows authenticated users to bypass those safety checks by combining allowlisted tools with shell positional parameters, enabling execution of unapproved commands outside the intended security boundaries. The impact depends on the operator's configuration and what input sources can reach the affected feature.
Technical details
This vulnerability is an authorization bypass and improper input neutralization issue (CWE-863, CWE-184) in OpenClaw's strict inline-eval checks. The root cause is insufficient validation of shell positional parameters when evaluating whether a command request is allowlisted. An authenticated operator can craft a request that combines a tool that is explicitly allowlisted with shell positional arguments ($1, $2, etc.) to inject inline-eval content into a shell carrier process that is not covered by the strict allowlist checks. The attack requires authentication and the affected feature must be enabled and reachable. The vulnerability allows execution of arbitrary shell-provided content outside intended security policies. OpenClaw 2026.4.2 and later patch this issue. Mitigation includes avoiding allowlisting shell carrier patterns, requiring approval for shell wrappers, and keeping allowlists narrow until patched.
Affected products
- OpenClaw openclaw < 2026.4.2
Timeline
- 2026-05-28: disclosed: Original advisory published on GitHub
- 2026-06-16: advisory: Duplicate advisory GHSA-27pq-2ph8-8x25 published then withdrawn on 2026-06-18
- 2026-04-02: patched: OpenClaw 2026.4.2 released with patch