Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.12 and involves an allowlist bypass in the handling of PowerShell encoded commands. Specifically, attackers can use abbreviated flag aliases that the allowlist parser does not recognize, allowing them to execute encoded PowerShell commands that should have been blocked.

Remote authenticated operators can exploit this flaw by using these unrecognized encoded-command alias forms to bypass execution allowlist checks and run arbitrary PowerShell content.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with remote authenticated access to execute arbitrary PowerShell commands on the affected system. This can lead to unauthorized actions, potentially compromising system integrity, confidentiality, and availability.

Because the attacker can bypass execution allowlist checks, they may perform malicious activities such as installing malware, stealing data, or disrupting services.

Useful 0 Not Useful 0