GHSA-fvx6-pj3r-5q4q OpenClaw's complex interpreter pipelines could skip exec script preflight validation

• npm openclaw: < 2026.4.2 → fixed in 2026.4.2

Summary Before OpenClaw 2026.4.2, exec script preflight validation could fail open on complex interpreter invocations such as pipes or other non-simple command forms. In those cases, script-content validation could be skipped entirely. Impact An attacker-controlled command shape could bypass the intended preflight validation for script execution. This weakened a defense-in-depth guard that was meant to block unsafe script content before execution. Affected Packages / Versions • Package: `openclaw` (npm) • Affected versions: `= 2026.4.2` • Latest published npm version: `2026.4.1` Fix Commit(s) • `8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513` — close the fail-open bypass in exec script preflight Release Process Note The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live. Thanks @iskindar for reporting, and thanks @wsparks-vc for coordination.