Home

Description

OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.

PUBLISHED Reserved 2026-02-27 | Published 2026-03-05 | Updated 2026-03-05 | Assigner VulnCheck




CRITICAL: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Product status

Default status
unaffected

Any version before 2026.2.2
affected

Credits

Petr Simecek (@simecek) reporter

Stanislav Fort, Aisle Research, www.aisle.com analyst

References

github.com/...enclaw/security/advisories/GHSA-3hcm-ggvf-rch5 (GitHub Security Advisory (GHSA-3hcm-ggvf-rch5)) vendor-advisory

github.com/...ommit/d1ecb46076145deb188abcba8f0699709ea17198 (Patch Commit) patch

www.vulncheck.com/...a-command-substitution-in-double-quotes (VulnCheck Advisory: OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes) third-party-advisory

cve.org (CVE-2026-28470)

nvd.nist.gov (CVE-2026-28470)

Download JSON