CVE-2026-100559

8 HIGHpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Public exploit & PoC references

https://github.com/openclaw/openclaw/security/advisories/GHSA-9f86-pvv5-rxfw

All references

https://github.com/openclaw/openclaw/security/advisories/GHSA-9f86-pvv5-rxfw
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-command-injection-via-escaped-newlines

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2022-51019PoC
HIGHCVE-2025-14754
HIGHCVE-2026-100292
HIGHCVE-2026-100368PoC
UNSCOREDCVE-2026-100382
HIGHCVE-2026-100599PoC
HIGHCVE-2026-100844PoC
HIGHCVE-2026-100852PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.