OpenClaw Preflight Validation Bypass Vulnerability in Shell-Bleed Protection

A preflight validation bypass vulnerability has been identified in OpenClaw versions prior to 2026.4.2. This vulnerability allows attackers to execute blocked script content by exploiting piped or complex command forms that bypass the parser's recognition. By crafting commands that use piped execution, command substitution, or subshell invocation, attackers can evade the 'validateScriptFileForShellBleed()' validation checks and execute arbitrary script content that would normally be restricted.

Impact

Exploitation of this vulnerability allows for bypassing the preflight validation of script execution, potentially leading to the execution of unsafe script content that could be harmful.

Reproduction

To reproduce this vulnerability, create a command that includes piped execution, command substitution, or subshell invocation. This command should be designed to bypass the 'validateScriptFileForShellBleed()' validation checks. When the command is executed, the blocked script content will be processed, demonstrating the validation bypass.

Remediation

Users can update to OpenClaw version 2026.4.2 or later to address this vulnerability.