Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-26323

OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts`. The issue affects contributors/maintainers (or CI) who run `bun scripts/update-clawtributors.ts` in a source checkout that contains a malicious commit author email (e.g. crafted `@users[.]noreply[.]github[.]com` values). Normal CLI usage is not affected (`npm i -g openclaw`): this script is not part of the shipped CLI and is not executed during routine operation. The script derived a GitHub login from `git log` author metadata and interpolated it into a shell command (via `execSync`). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run. Version 2026.2.14 contains a patch.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 67.5%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-26323
  • Openclaw » Openclaw » Version: 2026.1.10
    cpe:2.3:a:openclaw:openclaw:2026.1.10
  • Openclaw » Openclaw » Version: 2026.1.11
    cpe:2.3:a:openclaw:openclaw:2026.1.11
  • Openclaw » Openclaw » Version: 2026.1.11-1
    cpe:2.3:a:openclaw:openclaw:2026.1.11-1
  • Openclaw » Openclaw » Version: 2026.1.11-2
    cpe:2.3:a:openclaw:openclaw:2026.1.11-2
  • Openclaw » Openclaw » Version: 2026.1.11-3
    cpe:2.3:a:openclaw:openclaw:2026.1.11-3
  • Openclaw » Openclaw » Version: 2026.1.12
    cpe:2.3:a:openclaw:openclaw:2026.1.12
  • Openclaw » Openclaw » Version: 2026.1.12-2
    cpe:2.3:a:openclaw:openclaw:2026.1.12-2
  • Openclaw » Openclaw » Version: 2026.1.13
    cpe:2.3:a:openclaw:openclaw:2026.1.13
  • Openclaw » Openclaw » Version: 2026.1.14-1
    cpe:2.3:a:openclaw:openclaw:2026.1.14-1
  • Openclaw » Openclaw » Version: 2026.1.15
    cpe:2.3:a:openclaw:openclaw:2026.1.15
  • Openclaw » Openclaw » Version: 2026.1.16-2
    cpe:2.3:a:openclaw:openclaw:2026.1.16-2
  • Openclaw » Openclaw » Version: 2026.1.20
    cpe:2.3:a:openclaw:openclaw:2026.1.20
  • Openclaw » Openclaw » Version: 2026.1.21
    cpe:2.3:a:openclaw:openclaw:2026.1.21
  • Openclaw » Openclaw » Version: 2026.1.22
    cpe:2.3:a:openclaw:openclaw:2026.1.22
  • Openclaw » Openclaw » Version: 2026.1.23
    cpe:2.3:a:openclaw:openclaw:2026.1.23
  • Openclaw » Openclaw » Version: 2026.1.24
    cpe:2.3:a:openclaw:openclaw:2026.1.24
  • Openclaw » Openclaw » Version: 2026.1.24-1
    cpe:2.3:a:openclaw:openclaw:2026.1.24-1
  • Openclaw » Openclaw » Version: 2026.1.29
    cpe:2.3:a:openclaw:openclaw:2026.1.29
  • Openclaw » Openclaw » Version: 2026.1.30
    cpe:2.3:a:openclaw:openclaw:2026.1.30
  • Openclaw » Openclaw » Version: 2026.1.8
    cpe:2.3:a:openclaw:openclaw:2026.1.8
  • Openclaw » Openclaw » Version: 2026.1.9
    cpe:2.3:a:openclaw:openclaw:2026.1.9
  • Openclaw » Openclaw » Version: 2026.2.1
    cpe:2.3:a:openclaw:openclaw:2026.2.1
  • Openclaw » Openclaw » Version: 2026.2.12
    cpe:2.3:a:openclaw:openclaw:2026.2.12
  • Openclaw » Openclaw » Version: 2026.2.13
    cpe:2.3:a:openclaw:openclaw:2026.2.13
  • Openclaw » Openclaw » Version: 2026.2.2
    cpe:2.3:a:openclaw:openclaw:2026.2.2
  • Openclaw » Openclaw » Version: 2026.2.3
    cpe:2.3:a:openclaw:openclaw:2026.2.3
  • Openclaw » Openclaw » Version: 2026.2.6
    cpe:2.3:a:openclaw:openclaw:2026.2.6
  • Openclaw » Openclaw » Version: 2026.2.6-1
    cpe:2.3:a:openclaw:openclaw:2026.2.6-1
  • Openclaw » Openclaw » Version: 2026.2.6-2
    cpe:2.3:a:openclaw:openclaw:2026.2.6-2
  • Openclaw » Openclaw » Version: 2026.2.6-3
    cpe:2.3:a:openclaw:openclaw:2026.2.6-3
  • Openclaw » Openclaw » Version: 2026.2.9
    cpe:2.3:a:openclaw:openclaw:2026.2.9


Products
Pricing
Contact Us

Shodan ® - All rights reserved