Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-100559: OpenClaw before 2026.8.1 lets hidden commands run
CVE-2026-100559 · published 18 days ago
Summary
Versions of OpenClaw released before 2026.8.1 can be tricked into running commands that were not meant to be allowed. By using specially crafted input that includes escaped line breaks, an attacker can bypass the program’s checks and cause it to execute additional actions. Update OpenClaw to version 2026.8.1 or later to stop this behavior.
What to do
- Update openclaw openclaw to version 2026.8.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openclaw | openclaw | < 2026.8.1 |
Original advisory text
OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-9f86-pvv5-rxfw
- https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-command-injection-...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1005... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100559 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-78OS Command Injection
Timeline
Published26 Sep 2026
Updated13 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100559 · NVD
CVE-2026-100559 · MITRE
CVE-2026-100559 · OSV
GHSA-9f86-pvv5-rxfw · GHSA
Track software like this
Free during beta