Executive brief
OpenClaw ClawScan is a security scanning tool used to analyze code and files for vulnerabilities. A flaw in its file classifier allows an attacker to bypass content scanning by manipulating file type detection, potentially allowing malicious code to avoid detection during local scans.
Technical details
A logic error in the IsBinaryFile function of internal/runner/static_scanner.go allows bypassing content scanning through NUL byte interpretation conflicts. An attacker with local filesystem access can craft files with embedded NUL characters that are misclassified as binary, preventing the scanner from analyzing their actual content. The vulnerability requires local file system manipulation and does not affect remote scanning operations. A patch is available in version 0.1.7 (commit 04401337b3adb9343bd338b21e5e258bf49ca9c8).
Affected products
- OpenClaw ClawScan up to 0.1.6
Timeline
- 2026-09-15: disclosed
- 2026-08-14: patched: Patch commit 04401337b3adb9343bd338b21e5e258bf49ca9c8