by Kastro
Paper/Archive/CVE-2026-32917

CVE-2026-32917

OpenClaw OpenClaw — OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.8.808 × 2016.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without validation, enabling command execution when remote attachment staging is enabled.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.3.132026.3.13CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-g2f6-pwvx-r275patchgithub.com/openclaw/openclaw/commit/a54bf71b4c0cbe554a84340b773df37ee8e959dewriteupvulncheck.com/advisories/openclaw-remote-command-injection-via-unsanitized-imessage-attachment-paths-in-scp