Executive brief
OpenClaw is a platform that handles AI-driven task execution and tool management. An attacker can craft malicious tool metadata containing ANSI escape sequences that spoof terminal output in approval prompts and permission logs, misleading users about what tools are being approved. This could cause users to grant unintended permissions or overlook security-critical operations.
Technical details
The vulnerability is an ANSI escape sequence injection (CWE-116, CWE-150) in OpenClaw's ACP (Approval/Capability Protocol) CLI approval prompt handling. Tool titles from untrusted metadata sources are passed unsanitized into approval prompts and permission logging, where they can contain Control Sequence Introducer (CSI) sequences and other ANSI escape codes that alter terminal display behavior. An attacker controlling tool metadata can inject sequences to hide or modify displayed text, spoof approval messages, or inject fake prompts. The attack requires user interaction (displaying an approval prompt) but no authentication. The fix (commit 464e2c10a5edceb380d815adb6ff56e1a4c50f60) sanitizes tool titles at the source and broadens ANSI stripping to cover full CSI sequences. Patched in version 2026.3.25.
Affected products
- OpenClaw openclaw 2026.2.13 through 2026.3.24
Timeline
- 2026-03-29: disclosed: GHSA-4hmj-39m8-jwc7 published
- 2026-03-26: patched: Fix committed (464e2c10a5edceb380d815adb6ff56e1a4c50f60), released in version 2026.3.25