CVE-2026-25157
High · 7.7CVSS
7.7
EPSS
1.1%
Published
Feb 4, 2026
CISA due date
—
The record
OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | clawdbot | 0 | 2026.1.29 |
Related vulnerabilities
- GHSA-q284-4pvr-m585 OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand Same vulnerability
- CVE-2026-29612 OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers… Also affects clawdbot
- CVE-2026-28480 OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where… Also affects clawdbot
- CVE-2026-28478 OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook… Also affects clawdbot
- CVE-2026-28469 OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the… Also affects clawdbot
- CVE-2026-28452 OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the… Also affects clawdbot
- CVE-2026-26328 OpenClaw is a personal AI assistant. Also affects clawdbot
- CVE-2026-26317 OpenClaw is a personal AI assistant. Also affects clawdbot