{"id":"EUVD-2026-37157","enisaUuid":"d6ce95fd-bba8-3830-ad05-1b4bfafe81c0","description":"OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.","datePublished":"Jun 16, 2026, 6:05:03 PM","dateUpdated":"Jun 18, 2026, 3:55:55 AM","baseScore":7.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5cj2-3jr2-5h77\nhttps://www.vulncheck.com/advisories/openclaw-shell-positional-parameters-bypass-in-inline-eval-checks\n","aliases":"CVE-2026-53855\nGHSA-27pq-2ph8-8x25\nGHSA-5cj2-3jr2-5h77\n","assigner":"VulnCheck","epss":0.26,"enisaIdProduct":[{"id":"1b3d1a4f-8a10-38d1-8df7-ac040c380352","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.2"}],"enisaIdVendor":[{"id":"e7c51cb0-cd00-3a41-bf5e-241f56c0e59e","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"6b1e1595-71b7-361e-867f-c77a0646e89d","vulnerability":{"id":"GHSA-5cj2-3jr2-5h77","description":"OpenClaw: Shell positional parameters could weaken strict inline-eval checks","datePublished":"Jun 18, 2026, 8:12:12 PM","dateUpdated":"Jun 18, 2026, 8:12:12 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5cj2-3jr2-5h77\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53855\nhttps://github.com/openclaw/openclaw\nhttps://www.vulncheck.com/advisories/openclaw-shell-positional-parameters-bypass-in-inline-eval-checks\n","enisa_id":"EUVD-2026-37157\n","aliases":"CVE-2026-53855\nGHSA-5cj2-3jr2-5h77\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bcb2846b-5506-3c47-a958-fa2cf897a930","vulnerability":{"id":"GHSA-27pq-2ph8-8x25","description":"Duplicate Advisory: Shell positional parameters could weaken strict inline-eval checks","datePublished":"Jun 16, 2026, 9:31:59 PM","dateUpdated":"Jun 18, 2026, 8:11:47 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5cj2-3jr2-5h77\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53855\nhttps://www.vulncheck.com/advisories/openclaw-shell-positional-parameters-bypass-in-inline-eval-checks\n","enisa_id":"EUVD-2026-37157\n","aliases":"GHSA-27pq-2ph8-8x25\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e04db16c-ea78-3bb5-a945-41d652932ef2","vulnerability":{"id":"CVE-2026-53855","description":"OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.","datePublished":"Jun 16, 2026, 6:05:03 PM","dateUpdated":"Jun 18, 2026, 3:55:55 AM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5cj2-3jr2-5h77\nhttps://www.vulncheck.com/advisories/openclaw-shell-positional-parameters-bypass-in-inline-eval-checks\n","enisa_id":"EUVD-2026-37157\n","assigner":"VulnCheck","epss":0.26,"dataProcessed":"Oct 30, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"83787a87-1200-3591-a3f4-a69a185d50ae","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.2"}],"vulnerabilityVendor":[{"id":"ee648f82-1a90-30a5-8e00-e326bb0db2e0","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[]}