Executive brief
OpenClaw ClawScan is a security scanning tool used to analyze code and files for vulnerabilities. A logic flaw in its static scanner component causes it to skip certain files during scanning due to incomplete comparison logic, potentially missing security issues in Python bytecode and specially-named files.
Technical details
The vulnerability is an incomplete comparison with missing factors in the static_scanner.go component's file filtering logic. The flaw allows certain files to bypass the scanner's file-matching rules, affecting the detection of malicious code in Python bytecode and files with specific naming patterns. The attack vector is local, requiring access to the host running ClawScan. An attacker with local access could place malicious code in skipped files to evade security scanning. The issue is fixed in version 0.1.7 (patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa), which improved file scanning to properly handle skipped-name files and Python bytecode.
Affected products
- OpenClaw ClawScan up to 0.1.6
Timeline
- 2026-09-15: disclosed
- 2026-08-13: patched: Fix committed; version 0.1.7 available