PT-2026-31962 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-35651 · Published 2026-03-29 · Updated 2026-04-10

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.13 through 2026.3.24

Description OpenClaw contains an ANSI escape sequence injection vulnerability in approval prompts. Attackers can spoof terminal output through malicious tool titles, as untrusted tool metadata can carry ANSI control sequences into approval prompts and permission logs. This allows manipulation of displayed information.

Recommendations Update to version 2026.3.25 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-150

CWE-116

Related Identifiers

CVE-2026-35651

GHSA-4HMJ-39M8-JWC7

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35651.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4hmj-39m8-jwc7 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/464e2c10a5edceb380d815adb6ff56e1a4c50f60 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35651 · Security Note
• https://osv.dev/vulnerability/GHSA-4hmj-39m8-jwc7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35651 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-ansi-escape-sequence-injection-in-approval-prompt · Note
• https://twitter.com/CVEnew/status/2042710263359557714 · Twitter Post