OpenClaw/Clawdbot: Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Product

Vulnerabilities 2

• High 8.8
  CVE-2026-24763

  Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable

  OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when co…

  clawdbot clawdbot clawdbot npm
  Feb 2, 2026
• High 7.8
  CVE-2026-25157

  OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand

  OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied pro…

  OpenClaw OpenClaw clawdbot npm
  Feb 4, 2026

Revision history

1. 2026-02-04 #2

   Referenz(en) aufgenommen: EUVD-2026-5362

2. 2026-02-02 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2026-02-02
  https://github.com/advisories/GHSA-q284-4pvr-m585
• GitHub Advisory Database vom 2026-02-02
  https://github.com/advisories/GHSA-mc68-q9jw-2h3v