p PatchFirst

CVE-2026-53822

CVE-2026-53822 · OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls.

CVSS 8.7 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.5.18: Affected (semver)
    • 2026.5.18: Not affected (semver)

    Update to 2026.5.18

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.5.18

    Update to 2026.5.18

Original sources

Check your server →