Command Injection Vulnerability in OpenClaw Personal AI Assistant

CVE-2026-26323

What is CVE-2026-26323?

A command injection vulnerability exists in OpenClaw versions ranging from 2026.1.8 to 2026.2.13. This flaw is exposed when contributors or maintainers execute the script scripts/update-clawtributors.ts with a malicious commit author email, allowing attackers to inject shell commands via crafted metadata from git log. The vulnerable script processes this data unsafely, leading to potential arbitrary command execution. Normal operations remain unaffected, as this script is not included in standard usage. The issue has been addressed in version 2026.2.14.

References