BREW-OPENCLAW-CLI-CVE-20… (GHSA-782P-5FR5-7FJ8)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:21 – Updated: 2026-10-04 10:42 – Source website
VLAI
Summary
OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions
Details

Summary

When the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt.

Impact

Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input.

This is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure.

Affected Packages / Versions

  • npm: openclaw < 2026.2.3

Patched Versions

  • npm: openclaw >= 2026.2.3

Mitigation

  • If you do not use Slack: no action required.
  • If you use Slack: upgrade to a patched version.

Fix Commit(s)

  • 35eb40a7000b59085e9c638a80fd03917c7a095e

Thanks @KonstantinMirin for reporting.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "2026.2.3"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "openclaw-cli",
        "purl": "pkg:brew/openclaw-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/openclaw@2026.9.8",
        "name": "openclaw",
        "strategy": "registry",
        "subject_version": "2026.9.8"
      }
    ]
  },
  "details": "## Summary\nWhen the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model\u0027s system prompt.\n\n## Impact\nPrompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input.\n\nThis is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure.\n\n## Affected Packages / Versions\n- npm: `openclaw` \u003c 2026.2.3\n\n## Patched Versions\n- npm: `openclaw` \u003e= 2026.2.3\n\n## Mitigation\n- If you do not use Slack: no action required.\n- If you use Slack: upgrade to a patched version.\n\n## Fix Commit(s)\n- 35eb40a7000b59085e9c638a80fd03917c7a095e\n\nThanks @KonstantinMirin for reporting.",
  "id": "BREW-openclaw-cli-CVE-2026-24764",
  "modified": "2026-10-04T10:42:17Z",
  "published": "2026-08-13T17:21:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-782p-5fr5-7fj8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24764"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/35eb40a7000b59085e9c638a80fd03917c7a095e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.3"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions",
  "upstream": [
    "GHSA-782p-5fr5-7fj8",
    "CVE-2026-24764"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.