CVE-2026-44115
highOpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies.
Vendor / product: Openclaw — openclaw
OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.
CVSS
8.8
8.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-05-06 20:16
Modified: 2026-11-11 23:10
NVD status: Analyzed
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:13 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openclaw / openclaw <2026.4.22
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
Patch / mitigation: https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
References
- https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5 disclosure@vulncheck.com
- https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/openclaw-shell-expansion-bypass-in-unquoted-heredocs-... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗