CVE-2026-34425
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
OpenClaw prior to commit 8aceaf5 has a bypass vulnerability in shell-bleed protection, allowing attackers to execute blocked script content using pipes, command substitution, or subshells.
Risk Assessment
Attackers can execute arbitrary script code, potentially leading to system compromise or data leakage.
Recommendation
Update OpenClaw to a version containing commit 8aceaf5 or later.
Original NVD description (English source)
OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substitution, or subshell invocation to bypass the validateScriptFileForShellBleed() validation checks and execute arbitrary script content that would otherwise be blocked.