CVE-2026-100563

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1

Description The Control UI fails to neutralize leading characters that spreadsheet applications interpret as formulas when exporting session data to CSV. A lower-trust participant capable of influencing a session label or the first user message can inject a formula-like cell into the Usage export. If an operator opens this export in a spreadsheet application with formula evaluation enabled, the cell may be executed with the permissions of the spreadsheet user. This is a CSV injection issue where the software does not properly sanitize input before exporting it to a format that can be interpreted as executable code by other applications.

Recommendations Update to version 2026.8.1.