PT-2026-56869

CVE-2026-15193

Published

2026-07-09

Updated

2026-07-09

Description by

CVSS 3.1

5.3

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AidanPark openclaw-android versions prior to 0.4.1

Description An OS command injection issue exists within the Android WebView Bridge component, specifically in an unknown function located in the android/app/src/main/java/com/openclaw/android/JsBridge.kt file. This flaw allows for the execution of arbitrary operating system commands, although the attack can only be performed locally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Dem00000

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers