CVE-2026-53855
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.
- Affected products
- Openclaw
- Openclaw
- < 2026.4.2
- Fix
- Available
- CVSS 3.1
- 8.1 HIGH
- EPSS
- 0.3% (17th percentile)
- Weakness
- CWE-863, CWE-184
- NVD status
- Analyzed
- Published
- 2026-06-16
CVE-2026-53855 at NVD
1 known exploit for CVE-2026-53855
Proof-of-concept code and exploit modules indexed by Sploitus