Sean Nejad

BSim filter types concatenate user-supplied values directly into SQL queries without escaping or parameterization, leading to a SQL injection. This allows remote attackers to inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data within the PostgreSQL database.

A SQL injection issue exists in the `changePassword()` function of the PostgresFunctionDatabase. The system fails to escape double quotes in usernames that are interpolated into ALTER ROLE statements. Authenticated attackers can exploit this by sending crafted username parameters within PasswordChange network messages to execute arbitrary SQL commands, allowing them to escalate privileges to PostgreSQL superuser and obtain full control of the database.

An authentication bypass exists in the `PKIAuthenticationModule.authenticate()` function. This issue allows any user possessing a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Successful exploitation can lead to privilege escalation, modification of repository access controls, exfiltration of shared reverse engineering databases, and permanent compromise of server integrity.

The IsfServer accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation, leading to an unauthenticated path traversal. Remote attackers can connect to port '54321' and send crafted protobuf messages containing traversal sequences to enumerate filesystem paths and probe arbitrary files.

OpenClaw versions prior to 2026.2.23 contain an HTML injection issue in the HTML session exporter. This allows attackers to execute arbitrary JavaScript by injecting malicious `mimeType` values in image content blocks. Attackers can craft session entries with specially designed `mimeType` attributes that escape the `img src` data-URL context, leading to cross-site scripting (XSS) when the exported HTML is opened. The issue resides in the `src/auto-reply/reply/export-html/template.js` file, specifically at lines 1032 and 1306, where the `img.mimeType` is interpolated directly into `<img src="data:...">` attributes without proper validation or escaping. A crafted `mimeType` value, such as `x" onerror="alert(1)"`, can break out of the attribute context and execute arbitrary JavaScript. The vulnerability requires the attacker to control image entries in session data.

OpenClaw contains a path traversal issue in the Feishu media download process. Untrusted media keys are directly used in constructing temporary file paths within the `extensions/feishu/src/media.ts` file. An attacker controlling the Feishu media key values returned to the client can utilize traversal segments to bypass the `os.tmpdir()` directory and write arbitrary files with the permissions of the OpenClaw process. The issue stems from the direct interpolation of untrusted input (`imageKey` / `fileKey`) into file paths. This allows for manipulation of the path, potentially leading to file writes outside the intended temporary directory.

The software constructs RegExp objects directly from unescaped Feishu mention metadata within the `stripBotMention` function. This allows for potential regex injection and denial of service. Attackers can craft patterns with nested quantifiers or metacharacters in mention metadata to trigger catastrophic backtracking, potentially blocking message processing or removing unintended content before model processing. The vulnerable code resides in the `extensions/feishu/src/bot.ts` file, specifically when creating a `new RegExp()` from `mention.name` and `mention.key` without proper escaping of regex metacharacters.

OpenClaw versions prior to 2026.2.19 contain a command injection issue in the Lobster extension tool execution. This occurs due to the use of a Windows shell fallback mechanism with `shell: true` after process creation failures. Attackers can inject shell metacharacters into command arguments, potentially executing arbitrary commands when the subprocess launch fails with `EINVAL` or `ENOENT` errors. The issue resides in the `extensions/lobster/src/lobster-tool.ts` file, where the tool retries subprocess launch with `shell: true` on Windows for specific errors. The fix removes the shell fallback and uses explicit executable/script argv execution.