OpenClaw before version 2026.4.2 has an inline-eval bypass that allows authenticated operators to subvert strict allow‑list checks by using shell positional parameters. The flaw lets attackers combine allowed tools with positional arguments to embed inline‑eval content within shell carriers that fall outside the intended allow‑list, thereby executing shell code supplied by the attacker. The result is execution of arbitrary shell commands that are normally disallowed, potentially giving the attacker elevated privileges within the system.

All installations of OpenClaw OpenClaw using any release prior to 2026.4.2 are susceptible. The vulnerability is fixed in version 2026.4.2 and later.

The CVSS score of 7.6 indicates a high severity impact for authenticated users. Because the flaw requires valid access to the application, the attack vector is limited to trusted users rather than external attackers, which is reflected in the EPSS score of less than 1%. The vulnerability is not included in the CISA KEV catalog, indicating no known public exploits at the time of assessment. The potential for exploiting this weakness hinges on the ability of an attacker to run arbitrary commands via the application’s shell interface, which could lead to further compromise or privilege escalation within the controlled environment.