Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-fvx6-pj3r-5q4q
Advisory ID github_osv/GHSA-fvx6-pj3r-5q4q
Aliases CVE-2026-34425
Summary OpenClaw's complex interpreter pipelines could skip exec script preflight validation ## Summary Before OpenClaw 2026.4.2, exec script preflight validation could fail open on complex interpreter invocations such as pipes or other non-simple command forms. In those cases, script-content validation could be skipped entirely. ## Impact An attacker-controlled command shape could bypass the intended preflight validation for script execution. This weakened a defense-in-depth guard that was meant to block unsafe script content before execution. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.4.1` - Patched versions: `>= 2026.4.2` - Latest published npm version: `2026.4.1` ## Fix Commit(s) - `8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513` — close the fail-open bypass in exec script preflight ## Release Process Note The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live. Thanks @iskindar for reporting, and thanks @wsparks-vc for coordination.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-184 Incomplete List of Disallowed Inputs
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
https://github.com/openclaw/openclaw
8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513 Other https://github.com/openclaw/openclaw/commit/8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513
CVE-2026-34425 https://nvd.nist.gov/vuln/detail/CVE-2026-34425
GHSA-fvx6-pj3r-5q4q Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-fvx6-pj3r-5q4q
openclaw-shell-bleed-protection-preflight-validation-bypass Advisory https://www.vulncheck.com/advisories/openclaw-shell-bleed-protection-preflight-validation-bypass
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-03T13:00:24Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34425.json

Source Advisory: vulnrichment/CVE-2026-34425

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]