CVE-2026-24764

Katalog CVE

CVSS 3.7 · Low EPSS 0,21%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada openclaw. Skor CVSS 3.1 3.7 (Low) menurut github.com.

Deskripsi (NVD)

OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-782p-5fr5-7fj8 exploit · patch · advisory vendor
• https://github.com/openclaw/openclaw/commit/35eb40a7000b59085e9c638a80fd03917c7a095e patch
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.3 product · release notes