Openclaw cli: OpenClaw's complex interpreter pipelines could skip exec script preflight validation (CVE-2026-34425)

Before OpenClaw version 2026.4.2, the exec script preflight validation mechanism could fail open when handling complex interpreter invocations such as pipes or other non-simple command forms. This failure allowed script-content validation to be skipped entirely, enabling an attacker-controlled command shape to bypass the intended preflight validation. The vulnerability affects the openclaw npm package versions from 2026.1.29 up to but not including 2026.4.2. The fix was committed (commit 8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513) and is included in version 2026.4.2.

An attacker can craft complex command invocations that bypass the script preflight validation, potentially allowing unsafe or malicious script content to execute. This undermines a defense-in-depth control intended to prevent unsafe script execution, increasing the risk of executing harmful scripts.

Upgrade to OpenClaw version 2026.4.2 or later, where the fail-open bypass in exec script preflight validation is fixed. No other mitigation is required as the fix is available and should be applied once the patched version is released.