CVEvulnerability

CVE-2026-53822

8.7 HIGH Published 2026-06-12 Modified 2026-07-23 Official page ↗

Status: Analyzed
Published: 2026-06-12
Last modified: 2026-07-23
Assigner: [email protected]
CVSS 4.0 ([email protected]): 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-367, CWE-77

Description

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls.

Affected configurations

• openclaw openclaw (< 2026.5.18)

Weakness · CWE (2)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness
CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-2j8v-hwgc-x698 Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-command-argument-modification-via-shell-wrapper-between-approval-and-execution Third Party Advisory

CVE-2026-53822

Description

Affected configurations

Related

Weakness · CWE (2)

References