OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-44115 · CVE overview and exploitation status

EUVD-2026-28195

GHSA-x3h8-jrgh-p8jx

cve-program · CVE-2026-44115

• https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
• https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
• https://www.vulncheck.com/advisories/openclaw-shell-expansion-bypass-in-unquoted-heredocs-via-exec-allowlist

euvd · EUVD-2026-28195

• https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
• https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
• https://www.vulncheck.com/advisories/openclaw-shell-expansion-bypass-in-unquoted-heredocs-via-exec-allowlist

nvd · CVE-2026-44115

• https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
• https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
• https://www.vulncheck.com/advisories/openclaw-shell-expansion-bypass-in-unquoted-heredocs-via-exec-allowlist

osv · GHSA-x3h8-jrgh-p8jx

• https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
• https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
• https://github.com/openclaw/openclaw

No related changes are available here.