The vulnerability is a shell option parsing flaw that permits attackers to combine POSIX shell flags to bypass exec revalidation checks, allowing execution of inline shell content without the intended allowlist validation. This flaw, identified as CWE-367, can lead to unauthorized command execution when the affected feature is enabled in the application.

OpenClaw versions prior to 2026.5.12 are affected. The product runs on Node.js environments and is distributed as OpenClaw:OpenClaw. Users of these versions should verify the installed date and version before taking action.

The CVSS score is 7.7, indicating a high severity. EPSS information is not available, but the flaw is not listed in CISA KEV, suggesting no known widespread exploitation yet. The attack vector likely requires access to the application’s shell option handling, so actively enabled features or exposed interfaces could provide a pathway for exploitation. Due to the high severity score, immediate attention is warranted.