CVE-2026-26323: OpenClaw Personal AI Assistant RCE Flaw

CVE-2026-26323 Overview

CVE-2026-26323 is a command injection vulnerability affecting OpenClaw, a personal AI assistant application. The vulnerability exists in the maintainer/developer script scripts/update-clawtributors.ts where user-controlled input from git commit author metadata is interpolated into a shell command via execSync without proper sanitization. This allows attackers who can introduce malicious commit records to execute arbitrary commands when contributors or CI systems run the affected script.

Critical Impact

Attackers can achieve arbitrary command execution by crafting malicious commit author email addresses containing shell metacharacters, potentially compromising developer workstations or CI/CD pipelines.

Affected Products

• OpenClaw versions 2026.1.8 through 2026.2.13
• Development/maintainer environments running bun scripts/update-clawtributors.ts
• CI/CD pipelines processing repositories with malicious commit history

Discovery Timeline

• February 19, 2026 - CVE-2026-26323 published to NVD
• February 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26323

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the update-clawtributors.ts script, which is used by maintainers and contributors to update contributor information from git history.

The script parses git log output to extract author metadata, including email addresses. When processing email addresses that follow GitHub's noreply format (e.g., [email protected]), the script derives a GitHub login and passes it directly to execSync for shell execution. Because the email address is attacker-controlled through git commit records, an adversary can embed shell metacharacters that break out of the intended command context.

It is important to note that normal CLI usage of OpenClaw is not affected—the vulnerable script is not part of the shipped CLI package and is not executed during routine operation. The attack surface is limited to development and maintenance workflows where this specific script is executed against repositories containing malicious commit history.

Root Cause

The root cause is the direct interpolation of untrusted input (git commit author email metadata) into a shell command string passed to Node.js execSync. The script fails to sanitize or escape shell metacharacters before command execution, enabling command injection attacks.

Attack Vector

An attacker exploiting this vulnerability would need to introduce a malicious commit record into a repository that will later be processed by the vulnerable script. The attack vector involves crafting a commit with a specially constructed author email address containing shell metacharacters.

For example, an attacker could create a commit with an author email like:
foo$(malicious_command)@users.noreply.github.com

When the script processes this commit and attempts to derive the GitHub username, the shell metacharacters cause the injected command to execute. The attack requires the victim to run bun scripts/update-clawtributors.ts in a repository containing the malicious commit, which could occur during contributor updates or automated CI processes.

The vulnerability exploits the trust placed in git commit metadata, which can be arbitrarily set by anyone creating commits in a repository or through accepted pull requests.

Detection Methods for CVE-2026-26323

Indicators of Compromise

• Unusual command execution patterns spawned from Node.js or Bun processes running TypeScript scripts
• Git commits with suspicious author email addresses containing shell metacharacters (;, $(), backticks, |, &&, etc.)
• Unexpected network connections or file system modifications during contributor script execution
• CI/CD pipeline logs showing anomalous commands executed during build or maintenance scripts

Detection Strategies

• Monitor for child process spawning from development scripts with unexpected command arguments
• Implement git hook pre-receive validation to detect commits with suspicious author metadata patterns
• Enable command-line auditing on developer workstations and CI runners to capture shell execution events
• Review repository commit history for author emails containing special characters that could indicate injection attempts

Monitoring Recommendations

• Configure endpoint detection to alert on shell command injection patterns in process creation events
• Implement repository scanning for commits with potentially malicious author metadata before processing
• Monitor CI/CD pipeline execution logs for unexpected command execution during maintenance tasks
• Enable SentinelOne's behavioral AI to detect anomalous script execution patterns in development environments

How to Mitigate CVE-2026-26323

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.14 or later immediately
• Audit repository commit history for commits with suspicious author email addresses before running maintenance scripts
• Temporarily disable automated execution of update-clawtributors.ts until patched version is deployed
• Review CI/CD pipeline configurations to ensure they use the patched version

Patch Information

OpenClaw has released version 2026.2.14 which contains the security fix for this vulnerability. The patch is available via the GitHub Release v2026.2.14. The specific code changes can be reviewed in the GitHub Commit Update. Additional details are available in the GitHub Security Advisory GHSA-m7x8-2w3w-pr42.

Workarounds

• Avoid running bun scripts/update-clawtributors.ts on repositories that may contain untrusted commits
• If the script must be run, manually audit all commit author emails for shell metacharacters before execution
• Implement input validation wrapper to sanitize git log output before passing to the original script
• Use containerized or sandboxed environments when executing maintenance scripts against untrusted repositories

# Verify OpenClaw version is patched
npm list -g openclaw | grep openclaw
# Expected output should show version 2026.2.14 or higher

# Audit git history for suspicious author emails before running scripts
git log --format='%ae' | grep -E '[\$\`\;\|\&]' && echo "WARNING: Suspicious emails found"