CVE-2026-34425

תיאור (מקור, אנגלית)

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substitution, or subshell invocation to bypass the validateScriptFileForShellBleed() validation checks and execute arbitrary script content that would otherwise be blocked.

מדדים

CVSS 3.1

4.3 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS 4.0

5.3 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-27/7/2026

CWE

CWE-184

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-fvx6-pj3r-5q4q Vendor Advisory
• https://github.com/openclaw/openclaw/commit/8aceaf5d0f0ec552b75a792f7f0a3bfa5b‮… Patch
• https://www.vulncheck.com/advisories/openclaw-shell-bleed-protection-preflight‮… Third Party Advisory