Medium severity4.3NVD Advisory· Published Apr 10, 2026· Updated Apr 13, 2026
CVE-2026-35651
CVE-2026-35651
Description
OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof terminal output. Untrusted tool metadata can carry ANSI control sequences into approval prompts and permission logs, enabling attackers to manipulate displayed information through malicious tool titles.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | >= 2026.2.13, < 2026.3.28 | 2026.3.28 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/openclaw/openclaw/commit/464e2c10a5edceb380d815adb6ff56e1a4c50f60nvdPatchWEB
- github.com/advisories/GHSA-4hmj-39m8-jwc7ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-4hmj-39m8-jwc7nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-35651ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-ansi-escape-sequence-injection-in-approval-promptnvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.