CVE-2026-100559CWE-78command-injection

CVE-2026-100559

High · published September 26, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-26T07:17Z
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-9f86-pvv5-rxfw · [email protected]https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-command-injection-via-escaped-newlines · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 02:18Z
    OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
    cvelistv5