---
id: CVE-2026-34425
title: OpenClaw - Shell-Bleed Protection Preflight Validation Bypass
summary: >-
  OpenClaw versions prior to commit 8aceaf5 contain a preflight validation
  bypass vulnerability in shell-bleed protection that allows attackers to
  execute blocked script content by using piped or complex command forms that
  the parser fails…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-184
vendor: OpenClaw
product: OpenClaw
affected:
  - OpenClaw < 8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-03T13:00:24.379911Z'
published: '2026-04-02'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:06.054Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-34425'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-fvx6-pj3r-5q4q
    label: GitHub Security Advisory (GHSA-fvx6-pj3r-5q4q)
  - url: >-
      https://github.com/openclaw/openclaw/commit/8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513
    label: 'Patch Commit #1'
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-shell-bleed-protection-preflight-validation-bypass
tags:
  - cve.org
epss: 0.00315
epssPercentile: 0.24596
ingestedAt: '2026-11-08T14:51:22.456Z'
---

## Overview

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substitution, or subshell invocation to bypass the validateScriptFileForShellBleed() validation checks and execute arbitrary script content that would otherwise be blocked.

## Affected

- `OpenClaw < 8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.