PT-2026-99196

CVE-2026-100559

Published

2026-09-26

Updated

2026-10-17

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1

Description A command parser issue exists where escaped newlines interfere with the parsing of the exec allowlist. This allows attackers to craft input containing escaped newlines to bypass allowlist validation, enabling the execution of hidden commands without the required authorization prompts.

Recommendations Update to version 2026.8.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Tdjackey

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers