Allowlist Bypass Vulnerability in OpenClaw: Shell Inline-Command Parsing Issue
Summary
GHSA-v383-2wgg-v483: Duplicate Advisory: Shell inline-command parsing could miss an allowlist check. Affects openclaw versions < 2026.5.10-beta.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing and executing shell commands within applications. It provides a user-friendly interface for authenticated operators to run commands safely. However, prior to version 2026.5.12, OpenClaw had a critical vulnerability that allowed bypassing the command allowlist, potentially leading to unauthorized command execution.
Vulnerability Detail
The vulnerability arises from a flaw in the shell inline-command parsing mechanism of OpenClaw, which fails to enforce the expected allowlist checks. This oversight allows authenticated users to execute commands that should have been restricted, leading to potential security breaches. The vulnerability is classified under CWE-862, indicating a lack of authorization checks. The ramifications include unauthorized access to system commands, which could compromise the integrity and security of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the OpenClaw application for authenticated operators until the package is updated. Additionally, review and limit the commands that can be executed through the application to mitigate risks.
Conclusion
The allowlist bypass vulnerability in OpenClaw's shell inline-command parsing poses significant security risks for applications using this package. It is crucial for users to update to version 2026.5.12 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
If immediate updates are not possible, consider restricting access to the application and reviewing the commands that can be executed to minimize risk.
Yes, the vulnerability affects OpenClaw versions prior to 2026.5.12. Updating to this version or later will resolve the issue.
The potential consequences include unauthorized command execution, which could lead to data breaches, system compromise, and loss of integrity in the application.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
