VIR Vulnerability Intelligence Relay

CVE-2026-44115

high
Published 2026-05-06 · Modified 2026-05-07
CVSS v3
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2
—
VIR risk
8.8

Description

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: disclosure@vulncheck.com — https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx

vendor Authored 2026-05-27

Vendor advisory: disclosure@vulncheck.com — https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5

Application impact
VendorProductVersionsFixed
openclawopenclaw{"endExcluding":"2026.4.22"}2026.4.22

References

CWEs

CWE-184

Verify integrity in audit chain (admin only). AS-IS.