Executive brief
OpenClaw is an AI automation agent that executes tasks across multiple platforms. A flaw in how it constructs instructions for its underlying AI model allows an attacker to inject malicious commands by creating directories with specially-crafted names. If an attacker can control where OpenClaw runs, they could trick the AI into misusing its capabilities, potentially exposing sensitive data or performing unintended actions.
Technical details
OpenClaw constructs LLM agent system prompts by directly embedding the current working directory path without sanitizing control or format characters (CWE-77: Command Injection). An attacker can craft a directory name containing newlines, carriage returns, null bytes, tabs, or Unicode line/paragraph separators (U+2028, U+2029) and Unicode bidi/zero-width markers to break out of the prompt literal and inject arbitrary instructions into the LLM's system prompt. This requires local file system access to create such a directory and trigger OpenClaw to execute within it. The fix (v2026.2.15) applies sanitization to strip ASCII control characters and Unicode line/paragraph separators before embedding any workspace path into prompt output, with defense-in-depth sanitization also applied during workspace path resolution.
Affected products
- openclaw openclaw < 2026.2.15
Timeline
- 2026-02-18: disclosed: GHSA-2qj5-gwg2-xwc4 published
- 2026-02-15: patched: Fix released in v2026.2.15; patch commit 6254e96acf16e70ceccc8f9b2abecee44d606f79
- 2026-02-20: other: CVE-2026-27001 assigned