OpenClaw versions prior to 2026.5.12 have a vulnerability where PowerShell encoded-command aliases may bypass execution allowlist checks. This occurs because abbreviated encoded-command flags can use alias forms not recognized by the allowlist parser. The vulnerability affects configurations where this feature is enabled and reachable, potentially allowing execution of encoded PowerShell content without proper allowlist validation. The issue does not alter OpenClaw's trusted-operator model and depends on operator configuration and input trust levels. A fix is available in version 2026.5.12. Until patched, it is recommended to avoid allowlisting PowerShell wrapper forms and require approval for encoded commands. Additional hardening includes narrowing allowlists, isolating Gateway users, and disabling the affected feature if not needed.