p PatchFirst

CVE-2026-34425

CVE-2026-34425 · OpenClaw - Shell-Bleed Protection Preflight Validation Bypass

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substitution, or subshell invocation to bypass the validateScriptFileForShellBleed() validation checks and execute arbitrary script content that would otherwise be blocked.

CVSS 5.3 · Media · EPSS 0,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • openclaw

    Versiones
    • ≥ 0, < 8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513: Afectada (git)

    Sin corrección publicada

  • openclaw npm

    Intervalos de versiones afectados
    • SEMVER: < 2026.4.2

    Actualiza a 2026.4.2

Fuentes originales

Comprueba tu servidor →