CVE-2026-26323
📋 TL;DR
OpenClaw versions 2026.1.8 through 2026.2.13 have a command injection vulnerability in a developer script that processes git commit metadata. When maintainers or CI systems run the affected script, malicious commit author emails can execute arbitrary shell commands. Only developers and CI environments running the script from source are affected - normal CLI users are not vulnerable.
💻 Affected Systems
- OpenClaw
📦 What is this software?
Openclaw by Openclaw
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the developer's system or CI environment, allowing attackers to steal credentials, deploy malware, or pivot to other systems.
Likely Case
Limited impact on individual developer machines or isolated CI runners, potentially leading to credential theft or code modification.
If Mitigated
No impact if developers don't run the script or have updated to patched versions.
🎯 Exploit Status
Requires ability to inject malicious commit metadata into the repository and for developers to run the affected script.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.2.14
Vendor Advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-m7x8-2w3w-pr42
Restart Required: No
Instructions:
1. Update OpenClaw to version 2026.2.14 or later. 2. For source checkouts: git pull to get latest commit with fix. 3. Verify the script no longer uses unsafe shell command interpolation.
🔧 Temporary Workarounds
Avoid running the vulnerable script
allDo not execute the update-clawtributors.ts script from affected versions
# Do not run: bun scripts/update-clawtributors.ts
Sanitize git commit history
allReview and clean commit history to remove potentially malicious author emails
git log --format="%ae" | grep -E '[;&|`$]'
# Review suspicious emails
🧯 If You Can't Patch
- Implement strict code review processes to prevent malicious commits
- Run developer scripts in isolated containers or sandboxed environments
🔍 How to Verify
Check if Vulnerable:
Check OpenClaw version: if between 2026.1.8 and 2026.2.13, and you run scripts/update-clawtributors.ts from source, you are vulnerable.Check Version:
openclaw --version or check package.json version fieldVerify Fix Applied:
Verify version is 2026.2.14 or later, and check that the script uses safe command execution methods.📡 Detection & Monitoring
Log Indicators:
- Unexpected shell commands executed during script runs
- Suspicious process spawns from bun/node processes
Network Indicators:
- Unexpected outbound connections from developer workstations during script execution
SIEM Query:
Process execution where parent_process contains 'bun' or 'node' and command_line contains 'update-clawtributors'