CVE-2026-26323
Description
OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script scripts/update-clawtributors.ts. The issue affects contributors/maintainers (or CI) who run bun scripts/update-clawtributors.ts in a source checkout that contains a malicious commit author email (e.g. crafted @users[.]noreply[.]github[.]com values). Normal CLI usage is not affected (npm i -g openclaw): this script is not part of the shipped CLI and is not executed during routine operation. The script derived a GitHub login from git log author metadata and interpolated it into a shell command (via execSync). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run. Version 2026.2.14 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | >= 2026.1.8, < 2026.2.14 | 2026.2.14 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/openclaw/openclaw/commit/a429380e337152746031d290432a4b93aa553d55nvdPatchWEB
- github.com/advisories/GHSA-m7x8-2w3w-pr42ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-m7x8-2w3w-pr42nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-26323ghsaADVISORY
- github.com/openclaw/openclaw/releases/tag/v2026.2.14nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.