CVE-2026-27209

OpenClaw's shell allowlist analyzer allowed unquoted heredoc bodies to bypass token checks. In unquoted heredocs, the shell evaluates expansion tokens such as "$...", "$...", and backticks, which could execute unexpected commands while still passing allowlist analysis...