{"id":"CVE-2026-28470","aliases":["EUVD-2026-9916","GHSA-3hcm-ggvf-rch5"],"status":"published","title":"OpenClaw \u003c 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes","description":"OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00551,"percentile":0.46553,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78","CWE-88"],"published":"2026-02-17T16:46:12Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.2"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3hcm-ggvf-rch5","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/commit/d1ecb46076145deb188abcba8f0699709ea17198","tags":["patch","Patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-command-substitution-in-double-quotes","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28470","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3hcm-ggvf-rch5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28470.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-28470","title":"OpenClaw \u003c 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes","description":"OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.","status":"published","published":"2026-03-05T21:59:46.556Z","modified":"2026-04-22T18:51:38.361Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-9916","description":"OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.","status":"published","published":"2026-03-05T21:59:46Z","modified":"2026-04-22T18:51:38Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:24:19.81608Z"}],"ghsa":[{"id":"GHSA-3hcm-ggvf-rch5","title":"OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes","description":"### Summary\n\nExec approvals allowlist bypass via command substitution/backticks inside double quotes.\n\n### Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.1`\n- Fixed: `\u003e= 2026.2.2`\n\n### Impact\n\nOnly affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are unaffected.\n\n### Fix\n\nReject unescaped `$()` and backticks inside double quotes during allowlist analysis.\n\n### Fix Commit(s)\n\n- d1ecb46076145deb188abcba8f0699709ea17198\n\nThanks @simecek for reporting.","status":"published","published":"2026-02-17T16:46:12Z","modified":"2026-03-06T01:02:34Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78","CWE-88"],"updated_at":"2026-11-02T14:39:32.329372Z"}],"nvd":[{"id":"CVE-2026-28470","description":"OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.","status":"published","published":"2026-03-05T22:16:20.607Z","modified":"2026-06-17T10:28:42.263Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:07.852448Z"}],"osv":[{"id":"CVE-2026-28470","title":"OpenClaw \u003c 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes","description":"OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.","status":"published","published":"2026-03-05T21:59:46.556Z","modified":"2026-10-28T02:30:35.082495841Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-3hcm-ggvf-rch5","title":"OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes","description":"### Summary\n\nExec approvals allowlist bypass via command substitution/backticks inside double quotes.\n\n### Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.1`\n- Fixed: `\u003e= 2026.2.2`\n\n### Impact\n\nOnly affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are unaffected.\n\n### Fix\n\nReject unescaped `$()` and backticks inside double quotes during allowlist analysis.\n\n### Fix Commit(s)\n\n- d1ecb46076145deb188abcba8f0699709ea17198\n\nThanks @simecek for reporting.","status":"published","published":"2026-02-17T16:46:12Z","modified":"2026-03-06T01:16:31.725363Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78","CWE-88"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}