Command Injection Vulnerability in OpenClaw by OpenClaw

CVE-2026-100559

What is CVE-2026-100559?

OpenClaw versions prior to 2026.8.1 are susceptible to a command parser vulnerability that occurs when escaped newlines confuse the exec allowlist parsing mechanism. This loophole enables attackers to craft specific input containing escaped newlines, bypassing the intended allowlist validation. Consequently, this permits the execution of hidden commands without any expected authorization prompts, posing significant security risks to systems employing these versions.

References