CVE-2026-26323: OpenClaw Command Injection Vulnerability in Clawtributors Updater
Summary
CVE-2026-26323: OpenClaw has a command injection in maintainer clawtributors updater. Affects openclaw versions >= 2026.1.8, < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing contributions and maintainers within software projects. It provides tools for updating contributor information and streamlining the development process. However, it has been identified that the maintainer script 'scripts/update-clawtributors.ts' is vulnerable to command injection, which can be exploited by malicious commit authors.
Vulnerability Detail
The vulnerability arises from the way the 'update-clawtributors.ts' script processes GitHub login information derived from commit metadata. Specifically, it uses 'execSync' to execute shell commands that include interpolated user data. If a commit author email is crafted with malicious shell metacharacters, it can lead to arbitrary command execution when the script is run. This poses a significant risk to contributors and maintainers who execute the script in a source checkout containing such malicious data.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid running the 'scripts/update-clawtributors.ts' script in source checkouts that may contain untrusted commit author emails. Additionally, you can manually verify and sanitize commit author data before executing the script.
Conclusion
In summary, the command injection vulnerability in OpenClaw's clawtributors updater script poses a significant risk to contributors and maintainers. It is crucial to update to the patched version 2026.2.14 to mitigate this risk. Users should also be cautious when executing scripts that process commit metadata from untrusted sources.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions of OpenClaw are from v2026.1.8 to v2026.2.13, inclusive.
No, normal CLI usage is not affected as the vulnerable script is not part of the shipped CLI and is not executed during routine operations.
The vulnerability was reported by @scanleale and @MegaManSec from the AISLE Research Team.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
