CWE-184.

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

• Command injection
• CWE-184

<2026.5.26 · fixed in 2026.5.26

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

• CWE-184

<2026.5.6 · fixed in 2026.5.6

npm PraisonAI codeMode sandbox escape via Function constructor

• CWE-184
• CWE-693

>=1.4.0, <1.7.2 · fixed in 1.7.2

OpenClaw: Shell inline-command parsing could miss an allowlist check

• Broken access control
• CWE-184

<2026.5.12 · fixed in 2026.5.12

OpenClaw: Host environment sanitizer missed two Node.js control variables

• CWE-184

<2026.5.26 · fixed in 2026.5.26

Duplicate Advisory: PickleScan's profile.run blocklist mismatch allows exec() bypass

• CWE-184

* · no fixed version yet

Duplicate Advisory: Picklescan does not block ctypes

• CWE-184

<0.0.33 · fixed in 0.0.33

Duplicate Advisory: Picklescan has Incomplete List of Disallowed Inputs

• CWE-184

* · no fixed version yet

OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

• tinyhumansai OpenHuman
• Command injection
• CWE-184

n8n: Python Code Node AST Validator Bypass

• CWE-184
• CWE-693

<2.25.7 || >=2.26.0, <2.26.2 · fixed in 2.25.7, 2.26.2

Duplicate Advisory: Host environment sanitizer missed two Node.js control variables

• CWE-184

<=2026.5.22 · no fixed version yet

Duplicate Advisory: macOS Swift exec allowlist missed combined POSIX inline flags

• CWE-184

<=2026.5.5 · no fixed version yet

Duplicate Advisory: Shell positional parameters could weaken strict inline-eval checks

• CWE-184

* · no fixed version yet

Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers

• CWE-184

<=2026.5.22 · no fixed version yet

Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output

• CWE-184

<6.4.0 · fixed in 6.4.0

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

• Server-side request forgery (SSRF)
• CWE-184

>=5.4.0, <5.4.53 · fixed in 5.4.53

Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

• CWE-184

<2026.5.12 · fixed in 2026.5.12

File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

• Command injection
• CWE-184

<2.33.8 · fixed in 2.33.8

Spatie Laravel Media Library contains a file upload restriction bypass

• CWE-184

<11.23.0 · fixed in 11.23.0

FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable

• labring FastGPT
• Code injection
• CWE-184

Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

• Server-side request forgery (SSRF)
• CWE-184

<=8.32.0 · no fixed version yet

Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)

• Cross-site scripting (XSS)
• CWE-184

>=6.1.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 6.4.40, 7.4.12, 8.0.12

Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions

• zed
• Command injection
• CWE-184

Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions

• zed
• CWE-184

Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

• CWE-184
• CWE-436

>=6.1.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 6.4.40, 7.4.12, 8.0.12

CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

• Cross-site scripting (XSS)
• CWE-116

<2.2.7 || >=3.0.0.beta, <3.1.3 · fixed in 2.2.7, 3.1.3

Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation

• Eugeny tabby
• Open redirect
• CWE-184

Flowise has an MCP Security Bypass that Enables RCE

• Command injection
• CWE-184

<3.1.2 · fixed in 3.1.2

JunoClaw: plugin-shell shell-injection bypass via substring blocklist

• Dragonmonk111 junoclaw
• Command injection
• CWE-184

Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

• CWE-184

<=8.29.1 · no fixed version yet

Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

• CWE-184

<2026.4.10 · fixed in 2026.4.10

Duplicate Advisory: OpenClaw: Workspace dotenv could override runtime-control environment variables

• CWE-184

<2026.4.20 · fixed in 2026.4.20

Vvveb < 1.0.8.2 Authenticated RCE via Code Editor

• givanz Vvveb
• CWE-184

ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

• Server-side request forgery (SSRF)
• CWE-184

<=1.3.0 · no fixed version yet

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

• Broken access control
• CWE-184

<2026.4.23 · fixed in 2026.4.23

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

• Information disclosure
• CWE-184

<2026.4.22 · fixed in 2026.4.22

Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move

• Path traversal
• CWE-20

<=8.30.1 · no fixed version yet

OpenClaw: Workspace dotenv could override runtime-control environment variables

• CWE-184

<2026.4.20 · fixed in 2026.4.20

OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy

• Broken access control
• CWE-184

<2026.4.20 · fixed in 2026.4.20

Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

• CWE-184

<2026.3.28 · fixed in 2026.3.28

Xibo CMS API has SQL Injection via DataSet Filter Parameter

• xibosignage xibo-cms
• SQL injection
• CWE-184

Xerte Online Toolkits File Upload RCE via elfinder Connector

• thexerteproject xerteonlinetoolkits
• CWE-184

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

• CWE-184

<3.1.0 · fixed in 3.1.0

October CMS has Safe Mode Bypass via Twig Database Write Operations

• Broken access control
• CWE-184

<3.7.14 || >=4.0.0, <4.1.10 · fixed in 3.7.14, 4.1.10

October CMS has Safe Mode Bypass via CSS Preprocessor Compilers

• Path traversal
• Information disclosure

<3.7.14 || >=4.0.0, <4.1.10 · fixed in 3.7.14, 4.1.10

OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module

• Path traversal
• CWE-184

<20.17.0 · fixed in 20.17.0

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

• Command injection
• CWE-184

<3.1.0 · fixed in 3.1.0

OpenClaw: Discord event cover images bypassed sandbox media normalization

• Path traversal
• CWE-184

>=2026.4.7, <2026.4.10 · fixed in 2026.4.10

OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

• CWE-184

<2026.4.10 · fixed in 2026.4.10

OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms

• Command injection
• CWE-184

>=2026.2.22, <2026.4.12 · fixed in 2026.4.12

OpenClaw: Heartbeat owner downgrade missed local async exec completion events

• Privilege escalation
• CWE-184

>=2026.3.31, <2026.4.10 · fixed in 2026.4.10

OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events

• Broken access control
• CWE-184

>=2026.4.7, <2026.4.14 · fixed in 2026.4.14

PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code

• CWE-184

<0.1.8 · fixed in 0.1.8

Kimai leaks API Token Hash via Invoice Twig Template

• Code injection
• CWE-184

<2.53.0 · fixed in 2.53.0

LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

• CWE-184

>=0.0.0-20210305023314-538ac3df036e, <=0.0.0-20260226085519-736f34afb267 · no fixed version yet

Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

• CWE-184

<0.18.7 · fixed in 0.18.7

OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)

• Command injection
• CWE-184

<2026.4.8 · fixed in 2026.4.8

Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

• CWE-184

<2.1.13 · fixed in 2.1.13

OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)

• Command injection
• CWE-184

<2026.4.8 · fixed in 2026.4.8

OpenClaw: Windows-compatible env override keys could bypass system.run approval binding

• CWE-41
• CWE-178

<2026.4.2 · fixed in 2026.4.2