Inline-Eval Bypass Vulnerability in OpenClaw by OpenClaw

CVE-2026-53855

What is CVE-2026-53855?

OpenClaw prior to version 2026.4.2 is susceptible to an inline-eval bypass vulnerability. This flaw allows authenticated users to circumvent strict allowlist verifications through the manipulation of shell positional parameters. By exploiting this vulnerability, attackers can combine tools that are on the allowlist with shell positional arguments. This enables them to inject inline-eval content in shell carriers that fall outside the designated allowlist, potentially resulting in the execution of unauthorized shell content. For more information, check the latest GitHub Security Advisory.

References