CVE-2026-32917: OpenClaw remote command injection in iMessage attachment staging

CVE-2026-32917 · Severity: critical · CVSS 9.8 · Published 2026-03-31

OpenClaw, an automation tool for messaging, contains a security flaw in how it handles iMessage attachments. By sending a specially crafted filename, an attacker can trick the system into executing unauthorized commands on the servers configured to store these attachments. This could lead to a full system takeover, data theft, or disruption of services on the affected remote hosts.

Technologies: openclaw (npm), Openclaw. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-32917 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32917 being exploited in the wild.
How severe is CVE-2026-32917?
Critical severity, with a CVSS score of 9.8, published 31 March 2026.
Which products and versions are affected?
openclaw (npm) SEMVER:introduced=0,fixed=2026.3.13; Openclaw < 2026.3.13.
Is there a fix for CVE-2026-32917?
Yes. openclaw (npm): upgrade to 2026.3.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32917 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32917?
Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openclaw (npm): upgrade to 2026.3.13 or later
    npm install openclaw@2026.3.13

Technical details

A remote command injection vulnerability exists in OpenClaw's iMessage attachment staging flow within 'src/auto-reply/reply/stage-sandbox-media.ts'. When remote attachment staging is enabled, the application fails to sanitize shell metacharacters in attachment filenames before passing them as part of a remote operand to the SCP command. An unauthenticated remote attacker can exploit this by sending an iMessage with a malicious filename, leading to arbitrary command execution on the configured 'MediaRemoteHost'. The issue is resolved in version 2026.3.13 by implementing path validation and rejecting filenames containing shell metacharacters.

Affected products

  • OpenClaw OpenClaw < 2026.3.13

Identifiers

  • CVE-2026-32917
  • GHSA-g2f6-pwvx-r275

Timeline

  • 2026-03-14: patched: Fix committed and version 2026.3.13 released.
  • 2026-03-14: advisory: GitHub Security Advisory GHSA-g2f6-pwvx-r275 published.
  • 2026-03-31: disclosed: NVD and VulnCheck advisories published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.