CVE-2026-44115CWE-184

OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist

High · published May 6, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00606 · 48.3th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist
    cvelistv5