CVE-2026-53836: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

PowerShell accepts shortened spellings of its encoded-command option. OpenClaw's exec allowlist parser looked for the full flag and missed the aliases. A request using an abbreviated form passed the parser unrecognized, so the policy never evaluated the encoded payload. This is an incomplete deny list (CWE-184).

The attacker is an authenticated operator or an agent flow that can submit command requests to the Gateway, on a host where PowerShell is available. They send a PowerShell command with an alias flag and a base64-encoded script. Because the content is encoded, the allowlist could not inspect it even if it had tried. The result is arbitrary PowerShell with the privileges of the OpenClaw process on that host, which matches the high confidentiality, integrity and availability scores in the vector.

The advisory keeps the trusted-operator model unchanged and says impact depends on configuration. The risk is highest where allowlists are the only control between an agent or lower-trust user and the shell. The sources do not list the exact aliases.

The npm package openclaw at 2026.5.7 and earlier, when exec allowlist checks are used and PowerShell commands can be requested. Versions 2026.5.8 to 2026.5.11 are not listed as vulnerable, but 2026.5.12 is the first release the advisory names as patched.

npm ls openclaw

Use npm ls -g openclaw for a global install.

Upgrade to [email protected], the first stable patched version:

npm install [email protected]

Until then, the advisory says to avoid allowlisting PowerShell wrapper forms and to require approval for encoded commands. It also advises narrow channel and tool allowlists, not sharing one Gateway between mutually untrusted users, and disabling the exec feature when unneeded.

Search exec and command history on Windows hosts for powershell or pwsh invocations carrying a flag that abbreviates -EncodedCommand, followed by a long base64 string. Also check Windows PowerShell script block logging and process creation events for encoded command lines started by the OpenClaw process. Decode any payloads you find. The sources give no OpenClaw-specific log string. Beam records agent shell commands and its rules flag risky ones, which would cover an agent running encoded PowerShell on the same machine.

Summary

PowerShell encoded-command aliases could miss exec allowlist checks. In affected versions, a command request using abbreviated encoded-command flags could use an alias form not recognized by the allowlist parser.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could run encoded PowerShell content without the intended allowlist decision. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.12.

Mitigations

Avoid allowlisting PowerShell wrapper forms and require approval for encoded commands until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.