CVE-2026-22178CWE-1333

OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata

Medium · published March 18, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-03-18T01:34Z
EPSS history
Timeline
  • 18 MAR 01:34Z
    OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata
    cvelistv5