CVE-2026-100564

5.4 MEDIUMpublic exploit available

Published 2026-09-26 · Updated 2026-09-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses

CWE-1236

Public exploit & PoC references

https://github.com/openclaw/openclaw/security/advisories/GHSA-39hf-qg99-f4qv

All references

https://github.com/openclaw/openclaw/security/advisories/GHSA-39hf-qg99-f4qv
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-csv-formula-injection-via-attendance-export

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100563PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.