CVE-2026-53855

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.2

Description An inline-eval bypass allows authenticated operators to weaken strict allowlist checks using shell positional parameters. By combining allowlisted tools with shell positional arguments, attackers can place inline-eval content in shell carriers that fall outside the intended allowlist rules, enabling the execution of unapproved shell-provided content.

Recommendations Update to version 2026.4.2. Avoid allowlisting shell carrier patterns and require approval for shell wrappers. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.