PT-2026-26009 · Openclaw · Openclaw

Sean Nejad · Publicado 2026-02-19 · Atualizado 2026-03-18 · CVE-2026-22178

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.6 through 2026.2.17

Description The software constructs RegExp objects directly from unescaped Feishu mention metadata within the stripBotMention function. This allows for potential regex injection and denial of service. Attackers can craft patterns with nested quantifiers or metacharacters in mention metadata to trigger catastrophic backtracking, potentially blocking message processing or removing unintended content before model processing. The vulnerable code resides in the extensions/feishu/src/bot.ts file, specifically when creating a new RegExp() from mention.name and mention.key without proper escaping of regex metacharacters.

Recommendations OpenClaw versions 2026.2.6 through 2026.2.17 should be updated to version 2026.2.19 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

BDU:2026-05064

CVE-2026-22178

GHSA-C6HR-W26Q-C636

Produtos afetados

Openclaw

Referências · 12

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/7e67ab75cc2f0e93569d12fecd1411c2961fcc8c · Correção
• https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/74268489137510b6f6349919d1e197b17290d92c · Correção
• https://vulncheck.com/advisories/openclaw-redos-and-regex-injection-via-unescaped-feishu-mention-metadata · Nota
• https://twitter.com/CVEnew/status/2034136429807243340 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034137610017177604 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-c6hr-w26q-c636 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22178 · Nota de Segurança
• https://twitter.com/CVEarity/status/2034321834641088783 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05064 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-22178 · Aviso do Fabricante