CVSS 4.0
5.3 mediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-53861
Medium (5.3) in openclaw openclaw. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in openclaw 2026.5.6.
OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using combined flag forms, potentially allowing unauthorized command execution depending on operator configuration.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWE
- CWE-184
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c226-q6fx-6j6c | npm | openclaw | <2026.5.6 | 2026.5.6 |