VYPR
← All advisories
High severity8.8NVD Advisory· Published May 6, 2026· Updated May 7, 2026

CVE-2026-44115

CVE-2026-44115

Description

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • OpenClaw/Openclawreferences3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.22
    • (no CPE)range: < 2026.4.22

Patches

Vulnerability mechanics

References

3

News mentions

4