Remote Command Injection Vulnerability in OpenClaw
CVE-2026-32917

9.2CRITICAL

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
31 March 2026

What is CVE-2026-32917?

OpenClaw prior to version 2026.3.13 is affected by a remote command injection vulnerability due to the handling of unsanitized remote attachment paths in the iMessage attachment staging process. An attacker can exploit this flaw by sending crafted attachment paths containing shell metacharacters, which are then processed without proper validation, allowing arbitrary command execution on the configured remote hosts during the SCP operation. Organizations using OpenClaw should upgrade to the latest version to mitigate this risk.

Affected Version(s)

OpenClaw 0 < 2026.3.13

OpenClaw 2026.3.13

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/a54bf71b4c0cb...
patch
https://www.vulncheck.com/advisories/openclaw-remote-comm...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lintsinghua
.