PT-2026-20369 · Openclaw · Openclaw

Megamansec + 1 · Published 2026-02-18 · Updated 2026-02-20 · CVE-2026-26323

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.1.8 through 2026.2.13

Description The software contains a command injection issue in the scripts/update-clawtributors.ts script. This affects contributors or maintainers, and CI systems, who execute bun scripts/update-clawtributors.ts on a source checkout containing a malicious commit author email. The script extracts a GitHub login from git log author metadata and uses it in a shell command via execSync. A crafted commit record can inject shell metacharacters, leading to arbitrary command execution. Normal CLI usage, such as npm i -g openclaw, is not affected as the script is not part of the shipped CLI and is not executed during routine operation.

Recommendations Versions 2026.1.8 through 2026.2.13 should be updated to version 2026.2.14 or later. As a temporary workaround, avoid running the bun scripts/update-clawtributors.ts script on source checkouts with untrusted commit history.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26323

GHSA-M7X8-2W3W-PR42

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26323.json · Exploit
• https://github.com/openclaw/openclaw/commit/a429380e337152746031d290432a4b93aa553d55 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-m7x8-2w3w-pr42 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26323 · Security Note
• https://osv.dev/vulnerability/GHSA-m7x8-2w3w-pr42 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26323 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://t.me/CVEtracker/45203 · Telegram Post