Executive brief
OpenClaw, an automation tool for messaging, contains a security flaw in how it handles iMessage attachments. By sending a specially crafted filename, an attacker can trick the system into executing unauthorized commands on the servers configured to store these attachments. This could lead to a full system takeover, data theft, or disruption of services on the affected remote hosts.
Technical details
A remote command injection vulnerability exists in OpenClaw's iMessage attachment staging flow within 'src/auto-reply/reply/stage-sandbox-media.ts'. When remote attachment staging is enabled, the application fails to sanitize shell metacharacters in attachment filenames before passing them as part of a remote operand to the SCP command. An unauthenticated remote attacker can exploit this by sending an iMessage with a malicious filename, leading to arbitrary command execution on the configured 'MediaRemoteHost'. The issue is resolved in version 2026.3.13 by implementing path validation and rejecting filenames containing shell metacharacters.
Affected products
- OpenClaw OpenClaw < 2026.3.13
Timeline
- 2026-03-14: patched: Fix committed and version 2026.3.13 released.
- 2026-03-14: advisory: GitHub Security Advisory GHSA-g2f6-pwvx-r275 published.
- 2026-03-31: disclosed: NVD and VulnCheck advisories published.