cve.bz

CVE-2026-44115

8.7 highEPSS 0.4%

High (8.7) in openclaw openclaw. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in openclaw 2026.4.22.

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.

Severity

CVSS 4.0

8.7 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE
CWE-184
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-x3h8-jrgh-p8jxnpmopenclaw<2026.4.222026.4.22

References

Check your stackJSON