CVE-2026-100564: OpenClaw CSV Formula Injection Vulnerability

CVE-2026-100564 Overview

CVE-2026-100564 is a CSV formula injection vulnerability in OpenClaw versions before 2026.8.1. The flaw resides in the attendance export feature, which fails to neutralize spreadsheet formula characters contained within participant display names. When an administrator or user opens the exported CSV in a formula-enabled application such as Microsoft Excel or LibreOffice Calc, injected formulas execute with the spreadsheet user's permissions. The weakness is tracked under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File].

Critical Impact
Attackers who can set a participant display name can embed malicious formulas that run on the host of anyone opening the attendance CSV, enabling data exfiltration or local command execution via spreadsheet functions.

Affected Products

OpenClaw versions prior to 2026.8.1
Attendance CSV export functionality
Any downstream spreadsheet application that evaluates formulas on open (Excel, LibreOffice Calc, Google Sheets with import)

Discovery Timeline

2026-09-26 - CVE-2026-100564 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100564

Vulnerability Analysis

OpenClaw accepts participant display names as free-form text and writes them directly into attendance CSV exports. The export routine does not escape or prefix cells that begin with formula trigger characters such as =, +, -, @, Tab (0x09), or Carriage Return (0x0D). When a victim opens the file in a spreadsheet application that treats these prefixes as formulas, the embedded expression is evaluated in the victim's security context.

Formula injection in CSV output is a well-understood class of output encoding failure. Although the issuing application is not itself compromised, the trust boundary between the exporting application and the consuming spreadsheet client is crossed. Impact depends on the client's configuration; modern Excel prompts before executing external content, but legacy workflows and automated pipelines often bypass those prompts.

Root Cause

The root cause is missing output neutralization in the attendance export code path. User-supplied display name fields are concatenated into CSV rows without validation, sanitization, or a leading single-quote prefix that would force spreadsheet applications to treat the cell as literal text.

Attack Vector

An attacker registers or edits a participant profile and sets the display name to a crafted payload beginning with a formula trigger character. The payload remains dormant until an administrator exports the attendance report and opens the CSV. User interaction is required on the victim side, which aligns with the Passive User Interaction (UI:P) component in the published metrics. Typical payloads use HYPERLINK, WEBSERVICE, IMPORTXML, or Dynamic Data Exchange (DDE) invocations to exfiltrate adjacent cell data or launch local binaries.

No verified proof-of-concept code is available. See the GitHub Security Advisory GHSA-39hf-qg99-f4qv and the VulnCheck Advisory for OpenClaw for additional technical context.

Detection Methods for CVE-2026-100564

Indicators of Compromise

Participant display names that start with =, +, -, @, Tab, or Carriage Return characters.
Attendance CSV exports containing cells referencing functions such as HYPERLINK, WEBSERVICE, IMPORTXML, DDE, or cmd invocations.
Outbound HTTP requests from workstations immediately after opening exported attendance files.
Spreadsheet client prompts warning about external content triggered by exported OpenClaw CSVs.

Detection Strategies

Scan OpenClaw database tables and exported CSV files for display name fields beginning with formula trigger characters.
Inspect endpoint telemetry for child processes spawned by excel.exe, soffice.bin, or similar spreadsheet binaries shortly after opening CSV attachments.
Correlate CSV file opens with unexpected DNS lookups or external HTTP(S) connections from the office productivity suite.

Monitoring Recommendations

Alert on registration or profile update events where display name input matches the regex ^[=+\-@\t\r].
Monitor data loss prevention (DLP) logs for spreadsheet applications invoking network functions.
Track OpenClaw export audit logs to identify who generated and distributed attendance CSVs.

How to Mitigate CVE-2026-100564

Immediate Actions Required

Upgrade OpenClaw to version 2026.8.1 or later, which neutralizes formula characters in CSV exports.
Audit existing exported attendance CSVs for formula-prefixed cells before distribution.
Review all participant display names in the database and sanitize entries that begin with formula trigger characters.
Educate administrators to open untrusted CSV files in a text editor or with protected view enabled.

Patch Information

The maintainers addressed the issue in OpenClaw 2026.8.1. Refer to the GitHub Security Advisory GHSA-39hf-qg99-f4qv for release notes and commit references.

Workarounds

Prefix any cell value starting with =, +, -, @, Tab, or Carriage Return with a single quote (') during export, or wrap it in double quotes with an escaped leading apostrophe.
Disable automatic formula evaluation and Dynamic Data Exchange (DDE) in Microsoft Excel and LibreOffice Calc across managed workstations via group policy.
Restrict the ability to set display names to authenticated, trusted users until the patch is applied.
Convert exports from CSV to a non-executable format such as XLSX with explicit text typing, or PDF, where feasible.

bash

# Configuration example: enforce protected view and disable DDE in Excel via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v WorkbookLinkWarnings /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v DisableDDEServerLaunch /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v DisableDDEServerLookup /t REG_DWORD /d 1 /f