Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

OpenClaw command-injection, path-traversal, and link-following flaws (multiple vulnerabilities)

Vulnerability
First reported
Last updated
Happening score
H score 33
1 unique sources, 1 articles

Summary

Hide ▲

OpenClaw now has three patched high-severity vulnerabilities that can lead to credential theft, privilege escalation, and arbitrary code execution on the host. The set includes two command-injection flaws and one path traversal/link-following bug, with fixes in version 2026.6.6. A researcher said the issues can be triggered from an external WhatsApp message when lower-trust input reaches the affected paths.

Related Happenings

Shark RV2320EDUS / AV1102ARUS cross-model AWS IoT Exec_Command RCE flaw

Vulnerability
H score78 First: 16.07.2026 12:23 Last: 16.07.2026 12:23 Sources 1

About this happening: A SharkNinja vacuum certificate flaw now enables root command execution on other Shark vacuums in the same AWS region, exposing camera feeds, house maps, and *...

Open Happening

OpenClaw message-object prompt injection patched in 2026.4.23 security flaw

Vulnerability
H score15 First: 11.06.2026 20:46 Last: 11.06.2026 20:46 Sources 1

About this happening: OpenClaw has a patched message-object prompt injection flaw that let hidden instructions inside shared contacts, vCards, and location pins reach the LLM as trusted pro...

Open Happening

OpenClaw/OpenShell managed sandbox backend Claw Chain (multiple vulnerabilities)

Vulnerability
H score31 First: 15.05.2026 16:35 Last: 15.05.2026 16:35 Sources 1

About this happening: Researchers disclosed four OpenClaw flaws in the OpenShell managed sandbox backend that can be chained for data theft, privilege escalation, and persistence. T...

Open Happening

OpenClaw ClawJacked localhost WebSocket brute-force security flaw

Vulnerability
H score37 First: 01.03.2026 23:44 Last: 01.03.2026 23:44 Sources 1

About this happening: OpenClaw’s ClawJacked vulnerability allowed a malicious website to brute-force a localhost WebSocket connection and take control of a local instance, putting ses...

Open Happening

OpenClaw Control UI crafted-link RCE (CVE-2026-25253)

Vulnerability
H score32 First: 02.02.2026 18:28 Last: 02.02.2026 18:28 Sources 1

About this happening: OpenClaw CVE-2026-25253 is a high-severity 1-click RCE flaw that can expose gateway tokens and enable full gateway compromise on impacted instances. The weakne...

Open Happening

Timeline

  1. 10.07.2026 17:19 2 articles · 13d ago

    OpenClaw flaws enable host code execution and credential theft

    Initial Disclosure

    OpenClaw maintainers said three now-patched flaws in OpenClaw version 2026.6.6 include GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc, with two command-injection issues and one path-traversal/link-following bug that can enable credential theft, privilege escalation, arbitrary code execution, and host escape when lower-trust input reaches the affected paths. Chinmohan Nayak said the issues can be triggered from an external WhatsApp message.

    Show sources
    Open in new tab