QSearchQSearch

CVE-2026-53836

8.8 HIGH

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to exec...

Published: 2026-06-12 · Last updated: 2026-06-12

Severity and scoring

CVSS
8.8 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-184

Description

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-48557 — Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer() (8.8 HIGH)
  • CVE-2026-44287 — FastGPT is an AI Agent building platform (6.3 MEDIUM)
  • CVE-2026-44463 — Zed is a code editor (8.6 HIGH)
  • CVE-2026-44462 — Zed is a code editor (6.4 MEDIUM)
  • CVE-2026-45037 — Tabby (formerly Terminus) is a highly configurable terminal emulator (7.1 HIGH)