CVE-2026-100559
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines…
- Risk score
- 51/100
- CVSS
- 8.0 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.
- Affected
- See advisory
- Fix
- Upgrade the product to 2026.8.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.0 high
References
Original description
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.
Last activity 26 Sep 2026. Patch Forecast updates every hour.