CWE-184.

OpenClaw: Shell init-file options could satisfy exec allowlist script matching

• CWE-184

<2026.3.31 · fixed in 2026.3.31

OpenClaw's complex interpreter pipelines could skip exec script preflight validation

• CWE-184

<2026.4.2 · fixed in 2026.4.2

Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow

• Open redirect
• CWE-20

<11.16.1 · fixed in 11.16.1

OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

• Information disclosure
• CWE-184

<2026.3.31 · fixed in 2026.3.31

Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation

• CWE-184

<2026.4.2 · fixed in 2026.4.2

Duplicate Advisory: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

• CWE-184

<2026.3.22 · fixed in 2026.3.22

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

• CWE-184
• CWE-807

<2026.3.31 · fixed in 2026.3.31

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked X...

• CWE-184

<0.54.7 · fixed in 0.54.7

ByteDance DeerFlow LocalSandboxProvider Host Bash Escape

• Bytedance Inc. DeerFlow
• CWE-184

OpenClaw SSRF guard misses four IPv6 special-use ranges

• Server-side request forgery (SSRF)
• CWE-184

<2026.3.28 · fixed in 2026.3.28

OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

• CWE-184

<2026.3.28 · fixed in 2026.3.28

OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe

• oneuptime
• Command injection
• CWE-184

Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

• Cross-site scripting (XSS)
• CWE-116

<5.13.4 · fixed in 5.13.4

PbootCMS File Upload file.php incomplete blacklist

• PbootCMS
• CWE-183
• CWE-184

Duplicate Advisory: allowlist exec-guard bypass via env -S

• CWE-184

* · no fixed version yet

Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

• CWE-184

* · no fixed version yet

PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution

• CWE-184

<0.1.7 · fixed in 0.1.7

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

• Cross-site scripting (XSS)
• CWE-184

<=0.0.0-20260313024916-fd6526133bb3 · no fixed version yet

SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets

• Path traversal
• CWE-184

<=0.0.0-20260313024916-fd6526133bb3 · no fixed version yet

fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`

• CWE-184

<0.1.10 · fixed in 0.1.10

fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist

• CWE-184

<0.1.10 · fixed in 0.1.10

FastGPT Python Sandbox Bypass of File-Write Restriction

• labring FastGPT
• CWE-184

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

• Hard-coded credentials
• CWE-116

<2026.3.7 · fixed in 2026.3.7

OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers

• Broken access control
• CWE-184

<2026.3.7 · fixed in 2026.3.7

SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality

• CWE-184

>=3.0.0, <3.4.0 · fixed in 3.4.0

Fickling missing RCE-capable modules in UNSAFE_IMPORTS

• CWE-184

<0.1.9 · fixed in 0.1.9

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

• Command injection
• CWE-184

<2026.2.22 · fixed in 2026.2.22

OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write

• CWE-184

<2026.2.19 · fixed in 2026.2.19

OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

• CWE-184
• CWE-829

>=2026.2.22, <2026.2.23 · fixed in 2026.2.23

Craft CMS has Twig Function Blocklist Bypass

• Code injection
• CWE-184

>=4.0.0-RC1, <4.17.0-beta.1 || >=5.0.0-RC1, <5.9.0-beta.1 · fixed in 4.17.0-beta.1, 5.9.0-beta.1

PickleScan has multiple stdlib modules with direct RCE not in blocklist

• CWE-184
• CWE-693

<1.0.4 · fixed in 1.0.4

OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)

• CWE-184

<2026.2.21 · fixed in 2026.2.21

OpenClaw has allowlist exec-guard bypass via env -S

• CWE-184
• CWE-193

<2026.2.23 · fixed in 2026.2.23

OpenClaw's exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toybox sh -c)

• CWE-184

<2026.2.23 · fixed in 2026.2.23

OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

• Broken access control
• CWE-184

<2026.2.22 · fixed in 2026.2.22

OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode

• Broken access control
• CWE-184

<2026.2.23 · fixed in 2026.2.23

Fickling has safety check bypass via REDUCE+BUILD opcode sequence

• CWE-184

<0.1.8 · fixed in 0.1.8

IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame.

• Hitachi Energy RTU500 series CMU firmware
• CWE-184

Fickling has a detection bypass via stdlib network-protocol constructors

• CWE-184

<0.1.8 · fixed in 0.1.8

OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

• Command injection
• CWE-184

<2026.2.19 · fixed in 2026.2.19

Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER

• Code injection
• CWE-184

<1.0.3 · fixed in 1.0.3

FUXA Affected by a Path Traversal Sanitization Bypass

• Path traversal
• CWE-184

<1.2.11 · fixed in 1.2.11

Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

• Insecure deserialization
• CWE-184

<0.1.7 · fixed in 0.1.7

Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

• Insecure deserialization
• CWE-184

<0.1.7 · fixed in 0.1.7

Fickling Blocklist Bypass: cProfile.run()

• Insecure deserialization
• CWE-184

<0.1.7 · fixed in 0.1.7

Fickling has a bypass via runpy.run_path() and runpy.run_module()

• Insecure deserialization
• CWE-184

<0.1.7 · fixed in 0.1.7

libsodium has Incomplete List of Disallowed Inputs

• CWE-184

<1.24.0 || >=2, <2.5.0 · fixed in 1.24.0, 2.5.0

Picklescan has Incomplete List of Disallowed Inputs

• CWE-184

<0.0.33 · fixed in 0.0.33

Picklescan does not block ctypes

• CWE-184
• CWE-913

<0.0.33 · fixed in 0.0.33

Fickling has Code Injection vulnerability via pty.spawn()

• Code injection
• Insecure deserialization

<0.1.6 · fixed in 0.1.6

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

• Insecure deserialization
• CWE-184

<0.1.6 · fixed in 0.1.6

Improper Validation of Query Parameters in Auth0 Next.js SDK

• CWE-184

>=4.9.0, <4.13.0 · fixed in 4.13.0

PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

• CWE-184

<4.4.1 || >=5.0.0, <5.0.5 · fixed in 4.4.1, 5.0.5

Microsoft Windows: The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the…

• Microsoft Windows
• CWE-184
• CWE-820

Promptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG

• MarceloTessaro promptcraft-forge-studio
• Cross-site scripting (XSS)
• CWE-20

Promptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping Patterns

• MarceloTessaro promptcraft-forge-studio
• Cross-site scripting (XSS)
• CWE-20

WWBN AVideo: An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master…

• WWBN AVideo
• CWE-184

Unsafe handling of AJAX calls

• OTRS
• OTRS AG ((OTRS)) Community Edition
• CWE-184

A vulnerability exists in the media upload component of the Asset Suite versions listed below.

• Hitachi Energy Asset Suite
• CWE-184

Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

• CWE-184

* · no fixed version yet