CVE-2026-34425

Katalog CVE

CVSS 4.3 · Medium EPSS 0,40%

Kerentanan Incomplete List of Disallowed Inputs pada openclaw. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substitution, or subshell invocation to bypass the validateScriptFileForShellBleed() validation checks and execute arbitrary script content that would otherwise be blocked.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-fvx6-pj3r-5q4q advisory vendor
• https://github.com/openclaw/openclaw/commit/8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513 patch
• https://www.vulncheck.com/advisories/openclaw-shell-bleed-protection-preflight-validation-bypass advisory pihak ketiga