PT-2026-26009 · Openclaw · Openclaw

Sean Nejad · Published 2026-02-19 · Updated 2026-03-18 · CVE-2026-22178

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.6 through 2026.2.17

Description The software constructs RegExp objects directly from unescaped Feishu mention metadata within the stripBotMention function. This allows for potential regex injection and denial of service. Attackers can craft patterns with nested quantifiers or metacharacters in mention metadata to trigger catastrophic backtracking, potentially blocking message processing or removing unintended content before model processing. The vulnerable code resides in the extensions/feishu/src/bot.ts file, specifically when creating a new RegExp() from mention.name and mention.key without proper escaping of regex metacharacters.

Recommendations OpenClaw versions 2026.2.6 through 2026.2.17 should be updated to version 2026.2.19 or later.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2026-05064

CVE-2026-22178

GHSA-C6HR-W26Q-C636

Affected Products

Openclaw

References · 12

• https://github.com/openclaw/openclaw/commit/74268489137510b6f6349919d1e197b17290d92c · Patch
• https://github.com/openclaw/openclaw/commit/7e67ab75cc2f0e93569d12fecd1411c2961fcc8c · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22178 · Security Note
• https://osv.dev/vulnerability/GHSA-c6hr-w26q-c636 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05064 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2034137610017177604 · Twitter Post
• https://vulncheck.com/advisories/openclaw-redos-and-regex-injection-via-unescaped-feishu-mention-metadata · Note
• https://twitter.com/CVEnew/status/2034136429807243340 · Twitter Post
• https://twitter.com/CVEarity/status/2034321834641088783 · Twitter Post