5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34425

CVE-2026-34425: OpenClaw - Shell-Bleed Protection Preflight Validation Bypass

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substitution, or subshell invocation to bypass the validateScriptFileForShellBleed() validation checks and execute arbitrary script content that would otherwise be blocked.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34425

CVE-2026-34425:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the pre-execution validation logic for scripts within the 'exec' tool. The core issue is a "fail-open" design flaw. The system attempted to identify and validate scripts before execution, but the function responsible for parsing the command, extractScriptTargetFromCommand, was intentionally simple. It could not handle complex shell syntax such as pipes, command wrappers (bash -c), or even quoted script paths. When faced with such a command, it would return null. The calling function, validateScriptFileForShellBleed, would interpret this as a command that doesn't involve a script and would therefore skip the security validation. This allowed an attacker to craft a command that would bypass the check and execute a script with potentially malicious content. The patch rectifies this by replacing the simple parser with a more robust one and, more importantly, implementing a "fail-closed" mechanism. The new shouldFailClosedInterpreterPreflight function analyzes commands that the parser can't fully resolve. If it detects a complex command structure that appears to be executing a script, it now throws an error, preventing the execution, rather than silently allowing it to proceed without validation.

Vulnerable functions

validateScriptFileForShellBleed

src/agents/bash-tools.exec.ts

This function is responsible for the script preflight validation. Before the patch, it would fail open by simply returning if the `extractScriptTargetFromCommand` function could not parse the command. This allowed complex commands to bypass security validation entirely. The patch changes this behavior to fail-closed by throwing an error for ambiguous interpreter invocations.

extractScriptTargetFromCommand

src/agents/bash-tools.exec.ts

This function's simplistic implementation was the root cause of the vulnerability. It was designed to parse only simple command forms and would return `null` for complex invocations (e.g., using pipes, shell wrappers like `bash -c`, or quoted arguments). This `null` return value was interpreted by `validateScriptFileForShellBleed` as 'no script found', leading to the validation bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.